cbcvebase.
CVE-2025-42976
published 2025-08-12

CVE-2025-42976: SAP NetWeaver Application Server ABAP (BIC Document) allows an authenticated attacker to craft a request that, when submitted to a BIC Document application…

PriorityP344high8.1CVSS 3.1
AVNACLPRLUINSUCHINAH
EPSS
0.37%
29.3th percentile
SAP NetWeaver Application Server ABAP (BIC Document) allows an authenticated attacker to craft a request that, when submitted to a BIC Document application, could cause a memory corruption error. On successful exploitation, this results in the crash of the target component. Multiple submissions can make the target completely unavailable. A similarly crafted submission can be used to perform an out-of-bounds read operation as well, revealing sensitive information that is loaded in memory at that time. There is no ability to modify any information.

Affected

15 ranges
VendorProductVersion rangeFixed in
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.