Threats affecting pkg:maven/com.sap.netweaver/internet-graphics-service

CVE-2026-109807 is an integer overflow vulnerability in SAP NetWeaver's Internet Graphics Service. The service does not properly validate certain input values in incoming requests, allowing an unauthenticated attacker to send crafted requests that cause the worker process to read beyond declared values. This leads to repeated termination of the worker process, resulting in a denial of service and high impact on availability. There is no impact on confidentiality or integrity.

CVE-2026-109806 is an out-of-bounds read vulnerability in SAP NetWeaver's Internet Graphics Service. It arises from insufficient validation of input values in incoming requests. An unauthenticated attacker can send malformed image data that triggers an integer overflow, causing repeated termination of the worker process. This leads to a high impact on the availability of the service without affecting confidentiality or integrity.