CVE-2026-44756: CWE-120: Buffer Copy without Checking Size of Input in SAP_SE SAP Extended Passport (EPP) Processing

This vulnerability (CVE-2026-44756) is a buffer overflow issue classified under CWE-120 in the SAP Extended Passport (EPP) processing library. It occurs due to copying input data without verifying its size, allowing an unauthenticated attacker to send a specially crafted network request containing a malformed EPP header. Exploitation can cause undefined behavior and abnormal program termination, potentially compromising confidentiality, integrity, and availability of the affected application. The CVSS v3.1 score is 10.0, indicating critical severity with network attack vector, no privileges or user interaction required, and complete impact on confidentiality, integrity, and availability. The affected versions are explicitly enumerated.

Successful exploitation can lead to abnormal termination of the SAP EPP processing application, resulting in denial of service and potential compromise of confidentiality and integrity of the application data. The vulnerability is exploitable remotely without authentication, making it highly critical for affected deployments.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the SAP vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected SAP EPP processing service and monitor for suspicious malformed EPP header requests.