Introduction
SAP's Internet Graphics Service (IGS) works in the background of many NetWeaver landscapes, turning data supplied by SAP systems into charts and images. A newly disclosed flaw lets an unauthenticated attacker send a crafted request carrying malformed image data that repeatedly terminates the IGS worker process. SAP rates the issue 7.5 (High) under CVSS v3.1, entirely on the strength of its availability impact.
The public record lists the vendor as Unknown, but the affected vendor is SAP SE and the affected component is BC-FES-IGS. Two points stand out in the available material. The attack requires no account and no user interaction, and the disclosed consequence is limited to worker process termination, not data theft, data modification or code execution. Active exploitation, a public exploit and threat actor attribution have not been established, and none of those gaps should be read as proof that exploitation is impossible.
Technical information
Where the flaw sits
SAP describes IGS as a set of interconnected elements that communicate with SAP systems over network connections and use incoming data to generate graphics. The vulnerable logic therefore lives in a network service that parses externally supplied data, not in a purely local rendering routine.
Root cause
According to the CVE description, IGS does not sufficiently validate certain input values within incoming requests. When a request contains malformed image data, processing triggers an integer overflow, and the result is repeated termination of the worker process.
The assigned weakness is CWE-125, Out of bounds Read, which MITRE defines as reading data past the end, or before the beginning, of the intended buffer. The narrative describes an integer overflow while the CWE label describes a memory access weakness. A common pattern would be an overflowed size or offset calculation leading to a read outside a buffer, but the public record does not confirm this, and no source code is available. We therefore treat the relationship between the two as undisclosed and do not infer memory disclosure or a code execution path from the CWE label.
Attack flow
Based on the disclosed description, exploitation proceeds as follows:
- An unauthenticated user sends a specially crafted request to IGS containing malformed image data.
- IGS insufficiently validates certain input values in that request.
- Processing of those values triggers an integer overflow.
- The worker process terminates repeatedly, producing a high impact on availability.
What the advisory does not disclose
The public material is specific about the outcome but thin on mechanics. It does not identify:
- The offending input field, the arithmetic operation involved, or the overflow boundary
- The image decoder or library, or the image format that triggers the bug
- The request endpoint or request syntax
- How many requests are needed, whether workers restart automatically, or how long disruption lasts
- Whether other SAP services are affected beyond the IGS worker
- Affected operating systems or the first corrected patch level
It would be unsupported to stretch repeated worker termination into a claim that an entire SAP landscape becomes unavailable.
CVSS breakdown
SAP, acting as CNA, supplies the following vector, which NVD displays without an independent NVD assessment:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None (no SAP account is needed)
- User Interaction: None
- Scope: Unchanged
- Confidentiality: None
- Integrity: None
- Availability: High
Per the FIRST CVSS v3.1 specification, base metrics describe intrinsic severity. A 7.5 base score is not a probability of exploitation and says nothing about observed attack activity.
Exploitation status
As of November 10, 2026, available reporting does not establish exploitation in the wild, a public working exploit, target-specific indicators of compromise, or an attributed actor. CISA KEV status could not be conclusively determined from the accessible catalog content, so we do not label the CVE as either listed or absent. For context only, Unit 42 reported suspicious requests to /developmentserver/metadatauploader in late January 2025 that were likely testing CVE-2025-31324, a different NetWeaver vulnerability on a different endpoint. That history shows SAP systems attract attention, but it provides no evidence about this IGS flaw.
Affected systems and versions
The component identifier is BC-FES-IGS. The two authoritative records differ slightly, so we list them separately:
- NVD affected list: IGS 7.20EXT, 7.20_EXT2, 7.53, 7.54 and 7.81
- SAP CNA record (CVE API): the same releases, plus 9.16, which does not appear in the retrieved NVD affected product table
These are release labels, not patch levels. The public material does not state which patch level within each release corrects the issue, so the release label alone does not tell you whether a given installation is vulnerable.
Configuration notes from SAP's IGS documentation that are relevant when assessing exposure:
- Correction reference: SAP Security Note 3809934 is the official remediation reference. The note requires an SAP for Me sign-in, and the exact corrected build, prerequisites and any workaround were not available in public material.
- Integrated versus standalone: integrated IGS starts and stops with SAP WebAS, and the update procedures differ between integrated and standalone installations. SAP Note 931900 covers determining the installed IGS patch level, and SAP Note 896400 covers integrated upgrades.
- HTTP listener: SAP recommends deactivating the IGS HTTP listener when Web Dynpro Java is not used, and recommends protecting IGS with a firewall. These are general hardening measures, not documented fixes for this CVE.
- HTTP administration: disabled by default. When it is enabled, SAP Note 992171 describes tracing incoming HTTP requests with sender IP. The default state of administration should not be taken as proof that the vulnerable request processing is unreachable.
- Authorization: SAP recommends implementing authorization for SIGS and GRAPHICS_IGS_ADMIN in ABAP-based frontend technology, which is administrative hardening rather than a correction to image processing.
Vendor security history
SAP SE is headquartered in Walldorf, Germany, and was founded on April 1, 1972. By SAP's own figures, 86 of the world's 100 largest companies are SAP S/4HANA customers and roughly 80% of SAP customers are small and midsize enterprises. Those numbers describe reach, not how many organizations run a vulnerable IGS build.
IGS has a track record of input processing flaws, each with its own prerequisites and outcome:
- CERT/CC VU#259540 (2007): a specially crafted HTTP request could trigger a buffer overflow in IGS, potentially allowing a remote unauthenticated attacker to execute arbitrary code, possibly with elevated privileges. SAP addressed it in Note 968423.
- CVE-2021-27624: insufficient validation in
CiXMLIStreamRawBuffer::readRaw()allowed memory corruption and a system crash. The attacker was unauthenticated but first needed to retrieve an existing system state value, and system data could not be viewed or modified. SAP Note 3021050 is the reference. - CVE-2026-109806: malformed image data triggers an integer overflow and repeated worker termination, with no disclosed prerequisite beyond network access, and SAP Note 3809934 as the reference.
The shared component does not make these exploitation paths interchangeable. The 2007 code execution outcome and the 2021 state value prerequisite are not properties of the current flaw. SAP publishes corrections on its Security Patch Day, held the second Tuesday of each month, and its security reporting guidance asks researchers for affected versions, support package and patch levels, exploitation conditions and impact.
References
- NVD: CVE-2026-109806
- CVE Record: CVE-2026-109806
- CVE Services API record for CVE-2026-109806 (SAP CNA data)
- SAP Security Note 3809934 (SAP for Me sign in required)
- SAP Security Notes and News, Security Patch Day
- SAP Help: Internet Graphics Service Security
- SAP Help Portal: Internet Graphics Server (IGS)
- SAP Documentation: Installing and Updating the IGS
- MITRE CWE 125: Out of bounds Read
- FIRST CVSS v3.1 Specification Document
- CERT/CC VU#259540: SAP Internet Graphics Service buffer overflow
- CVE Record: CVE-2021-27624
- Unit 42 Threat Brief: CVE-2025-31324
- CISA Known Exploited Vulnerabilities Catalog
- SAP: Report a Security Issue
- SAP Vulnerability Disclosure Policy
- SAP Corporate Fact Sheet
- SAP Company Information
- White Hat IT Security: SAP Overflow, Too Much Data, Too Little Buffer
- Cal OES CSIC Cyber Advisory: Multiple Vulnerabilities Impacting SAP Products
