Input Validation Flaw in SAP NetWeaver's Internet Graphics Service
CVE-2026-120008

8.2HIGH

Key Information:

Vendor

SAP
Status
SAP Netweaver (internet Graphics Service)
Vendor
CVE Published:
10 November 2026

What is CVE-2026-120008?

SAP NetWeaver's Internet Graphics Service suffers from an input validation flaw that allows an unauthenticated user to send a specially crafted request. This vulnerability leads to an out-of-bounds memory write in a worker process, causing potential memory corruption or repeated termination of the affected process. The implications of this vulnerability primarily affect system availability, creating interruptions, while integrity remains largely unaffected and confidentiality is not compromised.

Affected Version(s)

SAP NetWeaver (Internet Graphics Service) BC-FES-IGS 7.20EXT

SAP NetWeaver (Internet Graphics Service) 7.20_EX2

SAP NetWeaver (Internet Graphics Service) 7.53

References

https://me.sap.com/notes/3809953
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.