Memory Corruption in SAP NetWeaver Master Data Management

July 30, 2026

Memory Corruption in SAP NetWeaver Master Data Management


Impact on Business

An unauthenticated remote attacker can cause the SAP MDM Server to crash by sending a specially crafted packet. This results in a Denial of Service (DoS), rendering the system unavailable to legitimate users and disrupting business processes that rely on Master Data Management services.


Vulnerability Details

A memory corruption vulnerability exists in the A2iArchive::Read() function of the SAP MDM Server. The vulnerability is caused by improper validation of input data during memory operations. By sending a malicious payload, an attacker can trigger a segmentation fault, causing the server process to terminate unexpectedly.


Solution

SAP has released SAP Note 3610006 which provides patched versions of the affected components.

The patches can be downloaded from https://me.sap.com/notes/3610006.

Onapsis strongly recommends SAP customers to download the related security fixes and apply them to the affected components in order to reduce business risks.


Report Timeline

  • 03/07/2025: Onapsis reports vulnerability to SAP
  • 06/10/2025: SAP issues the patch

References


Advisory Information

  • Public Release Date: 07/30/2026
  • Security Advisory ID: ONAPSIS-2026-00019
  • Researcher(s): Adrian Radulescu

Vulnerability Information

  • Vendor: SAP
  • Affected Components: SAP NetWeaver Master Data Management (Check SAP Note 3610006 for detailed information on affected releases)
  • Vulnerability Class: CWE-703: Improper Check or Handling of Exceptional Conditions
  • CVSS v3 score: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
  • Risk Level: High
  • Assigned CVE: CVE-2025-42994
  • Vendor patch Information: SAP Security NOTE 3610006

Affected Components Description

  • SAP MDM Server 7.1

About our Research Labs

Onapsis Research Labs provides the industry analysis of key security issues that impact mission-critical systems and applications. Delivering frequent and timely security and compliance advisories with associated risk levels, Onapsis Research Labs combine in-depth knowledge and experience to deliver technical and business-context with sound security judgment to the broader information security community.

Find all reported vulnerabilities at: https://github.com/Onapsis/vulnerability_advisories

This advisory is licensed under a Creative Commons 4.0 BY-ND International License

Back To Advisories

Further Reading

Advisory

Missing Authorization Check in SSC_E2E_STORE_BDCDATA

Missing Authorization Check in SSC_E2E_STORE_BDCDATA Impact on Business A remote, authenticated attacker can exploit a missing authorization check to insert arbitrary records into the INDX database table. This vulnerability has a low impact on the integrity of the system and its business applications. Vulnerability Details The remote-enabled function module SSC_E2E_STORE_BDCDATA within the SAP S4 Foundation…

Read More
Advisory

Open Redirection in SAP NetWeaver Application Server ABAP

Open Redirection in SAP NetWeaver Application Server ABAP Impact on Business An unauthenticated remote attacker can redirect users to arbitrary untrusted sites using a malicious link. Since the link initially points to a trusted server, phishing attempts are more likely to succeed, potentially leading to credential theft or other malicious actions against the victim. Vulnerability…

Read More
Advisory

SAP MDM Server – MDM Console Session Hijacking

SAP MDM Server – MDM Console Session Hijacking Impact on Business An unauthenticated remote attacker can hijack active sessions on the SAP MDM Console. This allows the attacker to access sensitive information, such as application logs and system details, and perform administrative actions, including the deletion of repositories. This vulnerability impacts the confidentiality, integrity, and…

Read More