SAP NetWeaver Memory Corruption Flaw Lets Attackers Send Corrupted Logon Tickets

A vulnerability in SAP NetWeaver AS ABAP and ABAP Platform (CVE-2025-42902) has been identified, allowing unauthenticated attackers to crash server processes through malformed SAP Logon or SAP Assertion Tickets.

The issue is rated as Medium severity with a CVSS 3.1 score of 5.3 . It originates from a NULL pointer dereference, which triggers memory corruption and process termination.

The affected versions include all supported releases from 7.22 through 9.16. SAP has released advisory notes and patches as of Mon, Oct 14, 2025.

The vulnerability ( CVE-2025-42902 ) arises from insufficient validation of incoming SAP Logon Tickets and SAP Assertion Tickets. Processing a corrupted ticket causes a NULL pointer dereference, leading to a crash of the ABAP work process.

Field Details

Product SAP NetWeaver AS ABAP and ABAP Platform

Affected Versions KRNL64NUC 7.22; 7.22EXT; KRNL64UC 7.22; 7.53; KERNEL 7.22; 7.54; 7.77; 7.89; 7.93; 9.14; 9.15; 9.16

CVE ID CVE-2025-42902

CVSS 3.1 Score 5.3 (MEDIUM)

This flaw can be exploited remotely over the network without authentication or user interaction. While confidentiality and integrity are not compromised, availability is affected. Repeated submissions can cause denial-of-service conditions.

The root cause is a NULL Pointer Dereference (CWE-476) during ticket parsing. The SAP application server expects a structured ticket object, but malformed input leads to an unexpected NULL reference. The work process attempts to access memory at this NULL pointer, resulting in a crash.

An adversary can craft a malformed ticket payload and send it via standard SAP logon interfaces without valid SAP user credentials. Each malformed ticket submission causes a work process to terminate, and with enough parallel connections, the entire server instance may become unresponsive.

work_process.access(ticket.header) # NULL dereference

This vulnerability is distinct from typical injection or authentication bypass issues, relying instead on a memory safety error in ticket handling. SAP has published security note 3627308 and issued patches. Administrators are advised to apply the provided updates immediately.

As a temporary workaround, organizations can block incoming ticket parsing by disabling external logon ticket acceptance on the SAP ICM component, though this may disrupt legitimate federated logins. Proactive patching remains the best defense, as no exploitation has been observed publicly. Regular security posture reviews and network-level filtering of SAP interfaces can further reduce risk. Configuring SAProuter or Web Dispatcher to allow only trusted sources will limit exposure.

Based on reporting by GBHackers.