Integer Overflow Vulnerability in SAP NetWeaver Internet Graphics Service
CVE-2026-109806

7.5HIGH

Key Information:

Vendor

SAP
Status
SAP Netweaver (internet Graphics Service)
Vendor
CVE Published:
10 November 2026

What is CVE-2026-109806?

The SAP NetWeaver Internet Graphics Service contains a vulnerability due to inadequate validation of input values from incoming requests. This flaw allows an unauthenticated user to craft and send specially malformed image data, which may lead to an integer overflow. Consequently, this can result in the repeated termination of the worker process, significantly affecting the service's availability. While this vulnerability does not compromise the integrity or confidentiality of the system, its impact on availability necessitates immediate attention and action.

Affected Version(s)

SAP NetWeaver (Internet Graphics Service) BC-FES-IGS 7.20EXT

SAP NetWeaver (Internet Graphics Service) 7.20_EXT2

SAP NetWeaver (Internet Graphics Service) 7.53

References

https://me.sap.com/notes/3809934
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.