This vulnerability (CWE-120) exists in the SAP Extended Passport (EPP) processing library where a buffer copy operation does not verify the size of the input. An unauthenticated attacker can send a specially crafted network request with a malformed EPP header to trigger this flaw. The resulting undefined behavior may lead to abnormal program termination and compromise the application's confidentiality, integrity, and availability. The CVSS v3.1 score is 10.0 (critical), reflecting network attack vector, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. Affected versions are explicitly listed and include multiple specific releases such as 7.22EXT, 7.53, 8.04, 9.18, and others. No official remediation or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation can lead to a complete compromise of the affected application, impacting confidentiality, integrity, and availability. The vulnerability allows an unauthenticated attacker to cause abnormal termination or potentially execute arbitrary code due to memory corruption. This poses a critical risk to systems running the affected SAP EPP versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor SAP's security advisories for updates. No vendor-provided mitigation or temporary fix is currently documented.