Riskcovery

CVE-2025-42902

Memory Corruption vulnerability in SAP Netweaver AS ABAP and ABAP Platform

State
Published
Severity
5.3 Medium
Published
Oct 14, 2025
Updated
Oct 14, 2025
Reserved
Apr 16, 2025

Read the record on cve.org

Description

Due to the memory corruption vulnerability in SAP NetWeaver AS ABAP and ABAP Platform, an unauthenticated attacker can send a corrupted SAP Logon Ticket or SAP Assertion Ticket to the SAP application server. This leads to a dereference of NULL which makes the work process crash. As a result, it has a low impact on the availability but no impact on the confidentiality and integrity.

Scores

CVSSScoreVectorSource
3.15.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsap

Weaknesses

Affected Products

ProductVersions
SAP Netweaver AS ABAP and ABAP PlatformSAP_SE
  • KRNL64NUC 7.22Affected
  • 7.22EXTAffected
  • KRNL64UC 7.22Affected
  • 7.53Affected
  • KERNEL 7.22Affected
  • 7.54Affected
  • 7.77Affected
  • 7.89Affected
  • 7.93Affected
  • 9.14Affected
  • 9.15Affected
  • 9.16Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.