Home

Description

A memory corruption vulnerability exists in SAPCAR allowing an attacker to craft malicious SAPCAR archives. When a high privileged victim extracts this malicious archive, it gets processed by SAPCAR on their system, resulting in out-of-bounds memory read and write. This could lead to file extraction and file overwrite outside the intended directories. This vulnerability has low impact on the confidentiality, integrity and availability of the application.

PUBLISHED Reserved 2025-04-16 | Published 2025-07-08 | Updated 2025-07-08 | Assigner sap




MEDIUM: 4.0CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

Problem types

CWE-787: Out-of-bounds Write

Product status

Default status
unaffected

SAP_CAR 7.53
affected

7.22EXT
affected

References

me.sap.com/notes/3595141

url.sap/sapsecuritypatchday

cve.org (CVE-2025-42971)

nvd.nist.gov (CVE-2025-42971)

Download JSON