---
id: "CVE-2026-109807"
page: "https://infrastack.ai/live/CVE-2026-109807"
kind: "vulnerability"
aliases: ["CVE-2026-109807"]
title: "SAP NetWeaver Internet Graphics Service: crafted request lets an unauthenticated attacker repeatedly crash the worker (integer overflow)"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "SAP NetWeaver Internet Graphics Service", "fixed": [], "affected": "7.20_EXT2 - 9.16 (per CVE record via OffSeq; unconfirmed on SAP note)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["dos", "igs", "netweaver", "sap", "self-hosted", "vendor"]
not_affected_if: ["igs-not-installed"]
published_at: "2026-11-10T01:17:15+00:00"
first_seen_at: "2026-11-10T01:26:38+00:00"
updated_at: "2026-11-10T01:34:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109807", "first_seen_at": "2026-11-10T01:26:38+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109807", "first_seen_at": "2026-11-10T01:34:48+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-109807", "https://radar.offseq.com/threat/cve-2026-109807-cwe-190-integer-overflow-or-wraparound-in-sapse-sap-netweaver-internet-graphics-service-5aa7c1ae0246e697"]}]
exploit_sources: []
---

# SAP NetWeaver Internet Graphics Service: crafted request lets an unauthenticated attacker repeatedly crash the worker (integer overflow)

Link for people: https://infrastack.ai/live/CVE-2026-109807 (this .md is for agents)

SAP NetWeaver's Internet Graphics Service does not validate certain input values, so a crafted request makes it read past declared values. An unauthenticated attacker can repeatedly terminate the worker process, causing a denial of service with no confidentiality or integrity impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SAP NetWeaver Internet Graphics Service affected 7.20_EXT2 - 9.16 (per CVE record via OffSeq; unconfirmed on SAP note) fixed no fixed version listed

## How to check

- Check whether the Internet Graphics Service (IGS) is installed and running on your SAP NetWeaver landscape (including IGS reachable from the network).
- Open SAP Security Note 3809934 in SAP for Me (login required) and compare your IGS/NetWeaver patch level with its affected and corrected releases. Per a third-party summary of the CVE record the affected range is 7.20_EXT2 to 9.16; not confirmed on SAP's own page.

## Timeline

- 2026-11-10T01:26:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109807
- 2026-11-10T01:34:48+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-109807 — SAP note 3809934 (me.sap.com, login-walled) is the primary source; could not read it. Patch Day Nov 2026 page not available. Affected range 7.20_EXT2-9.16 from OffSeq's copy of the CVE record; fixed version unknown. CWE-190, CVSS 7.5, no exploitation or PoC found. Nothing marked verified. Settle by reading note 3809934.

## Documents

- [describes] NVD: CVE-2026-109807 (CNA: SAP SE) https://nvd.nist.gov/vuln/detail/CVE-2026-109807
- [mentions] OffSeq Threat Radar: CVE-2026-109807 https://radar.offseq.com/threat/cve-2026-109807-cwe-190-integer-overflow-or-wraparound-in-sapse-sap-netweaver-internet-graphics-service-5aa7c1ae0246e697

## From the sources

SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request causing the affected process to read beyond the declared values, resulting in repeated termination of the worker process. This results in a high impact on availability with no impact on integrity or confidentiality.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_