{"id":"CVE-2026-120008","kind":"vulnerability","aliases":["CVE-2026-120008"],"related":[],"title":"SAP NetWeaver: unauthenticated request can corrupt memory and crash worker processes","description":"SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request to trigger an out-of-bounds memory write in a worker process. Successful exploitation could result in memory corruption or repeated termination of the affected process, resulting in a high impact on availability and a low impact on integrity with no impact on confidentiality.","summary":"SAP NetWeaver's Internet Graphics Service does not validate certain input values, allowing an out-of-bounds memory write in a worker process. An unauthenticated attacker can send a crafted request to corrupt memory or repeatedly crash the process.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SAP NetWeaver","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"SAP NetWeaver Internet Graphics Service","fixed":[],"affected":"7.20EXT, 7.20_EX2, 7.53, 7.54, 7.81, 9.16","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["internet-graphics-service","runtime","sap-netweaver","self-hosted","unauthenticated"],"not_affected_if":["unknown"],"how_to_check":"Check whether you run SAP Internet Graphics Service (IGS) in versions 7.20EXT, 7.20_EX2, 7.53, 7.54, 7.81 or 9.16 (embedded or standalone), then open SAP Security Note 3809953 on me.sap.com for the fixed patch level.","fix":null,"status":"open","published_at":"2026-11-10T01:17:15+00:00","first_seen_at":"2026-11-10T01:26:39+00:00","triaged_at":"2026-11-10T01:28:18+00:00","updated_at":"2026-11-10T01:34:54+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T01:28:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SAP NetWeaver: unauthenticated request can corrupt memory and crash worker processes","impact":"medium","summary":"SAP NetWeaver's Internet Graphics Service does not validate certain input values, allowing an out-of-bounds memory write in a worker process. An unauthenticated attacker can send a crafted request to corrupt memory or repeatedly crash the process.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["sap-netweaver","internet-graphics-service","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Worker process memory corrupted or repeatedly terminated by unauthenticated requests","analyst_note":"Find SAP's security note for CVE-2026-120008 to confirm affected releases, fixed patch level and whether the Internet Graphics Service is enabled by default (https://nvd.nist.gov/vuln/detail/CVE-2026-120008).","how_to_check":"- unknown","plain_action":"","product_name":"SAP NetWeaver","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running SAP NetWeaver with the Internet Graphics Service exposed to requests. The sources do not name affected release ranges or whether the service is enabled by default, so check your SAP NetWeaver deployment and SAP's security notes for this CVE.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000737,"input_tokens":4590,"output_tokens":556,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find SAP's security note for CVE-2026-120008 to confirm affected releases, fixed patch level and whether the Internet Graphics Service is enabled by default (https://nvd.nist.gov/vuln/detail/CVE-2026-120008).","search":"'-120008':14A,17A '-2026':13A,16A 'affect':126C 'allow':49B 'attack':63B 'avail':134C 'bound':54B,107C 'certain':46B,86C 'confidenti':145C 'corrupt':6A,70B,120C 'could':95C,116C 'craft':67B,99C 'crash':9A,74B 'cve':12A,15A 'exploit':115C 'graphic':27B,41B,80C 'graphics':23A 'high':131C 'host':35B 'impact':132C,138C,143C 'incom':90C 'input':47B,87C 'integr':140C 'internet':22A,26B,40B,79C 'internet-graphics-servic':25B 'low':137C 'memori':7A,55B,71B,108C,119C 'netweav':2A,32B,38B,78C 'netweaver':19A,21A 'out-of-bound':51B,104C 'process':11A,60B,76B,113C,127C 'repeat':73B,122C 'request':4A,68B,91C,100C 'result':117C,128C 'runtim':29B 'sap':1A,18A,20A,31B,37B,77C 'sap-netweav':30B 'self':34B 'self-host':33B 'send':65B,96C 'servic':28B,42B,81C 'service':24A 'special':98C 'success':114C 'suffici':84C 'termin':123C 'trigger':102C 'unauthent':3A,36B,62B,93C 'user':94C 'valid':45B,85C 'valu':48B,88C 'within':89C 'worker':10A,59B,112C 'write':56B,109C","nicknames":[],"mitigations":[],"who_affected":"Organizations running SAP NetWeaver with the Internet Graphics Service exposed to requests. The sources do not name affected release ranges or whether the service is enabled by default, so check your SAP NetWeaver deployment and SAP's security notes for this CVE.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["netweaver","netweaverinternetgraphicsservice","sapnetweaver","sapnetweaverinternetgraphicsservice"],"ptokens":["graphics","internet","netweaver","sap","service"],"labels":["high","internetgraphicsservice","runtime","sapnetweaver","selfhosted","unauthenticated","vendor"],"campaign_type":null,"search_a":"'-120008':14A,17A '-2026':13A,16A 'corrupt':6A 'crash':9A 'cve':12A,15A 'graphics':23A 'internet':22A 'memori':7A 'netweav':2A 'netweaver':19A,21A 'process':11A 'request':4A 'sap':1A,18A,20A 'service':24A 'unauthent':3A 'worker':10A","search_b":"'allow':49B 'attack':63B 'bound':54B 'certain':46B 'corrupt':70B 'craft':67B 'crash':74B 'graphic':27B,41B 'host':35B 'input':47B 'internet':26B,40B 'internet-graphics-servic':25B 'memori':55B,71B 'netweav':32B,38B 'out-of-bound':51B 'process':60B,76B 'repeat':73B 'request':68B 'runtim':29B 'sap':31B,37B 'sap-netweav':30B 'self':34B 'self-host':33B 'send':65B 'servic':28B,42B 'unauthent':36B,62B 'valid':45B 'valu':48B 'worker':59B 'write':56B","search_c":"'affect':126C 'avail':134C 'bound':107C 'certain':86C 'confidenti':145C 'corrupt':120C 'could':95C,116C 'craft':99C 'exploit':115C 'graphic':80C 'high':131C 'impact':132C,138C,143C 'incom':90C 'input':87C 'integr':140C 'internet':79C 'low':137C 'memori':108C,119C 'netweav':78C 'out-of-bound':104C 'process':113C,127C 'repeat':122C 'request':91C,100C 'result':117C,128C 'sap':77C 'send':96C 'servic':81C 'special':98C 'success':114C 'suffici':84C 'termin':123C 'trigger':102C 'unauthent':93C 'user':94C 'valid':85C 'valu':88C 'within':89C 'worker':112C 'write':109C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120008","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120008","severity":null,"published_at":"2026-11-10T01:17:15+00:00","modified_at":"2026-11-10T01:17:15+00:00","first_seen_at":"2026-11-10T01:26:39+00:00","fetched_at":"2026-11-10T01:26:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120008:2388","url":"https://hol.org/guard/security/cves/CVE-2026-120008-memory-corruption-vulnerability-in-sap-netweaver","severity":null,"published_at":"2026-11-10T01:34:54+00:00","modified_at":"2026-11-10T01:34:54+00:00","first_seen_at":"2026-11-10T01:34:54+00:00","fetched_at":"2026-11-10T01:34:54+00:00","note":"SAP note 3809953 (me.sap.com, login-walled, not readable) is the primary; I read only the CVE List record mirrored by HOL. Fixed patch level and whether IGS is enabled by default remain unconfirmed; nothing verified. X not checked.","cites":["https://hol.org/guard/security/cves/CVE-2026-120008-memory-corruption-vulnerability-in-sap-netweaver"]}],"documents":[{"id":112466,"url":"https://hol.org/guard/security/cves/CVE-2026-120008-memory-corruption-vulnerability-in-sap-netweaver","title":"HOL Guard record for CVE-2026-120008 (mirrors CVE List; cites SAP note 3809953)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}