Introduction
CVE-2025-42976 is a memory corruption vulnerability in the BIC Document component of SAP NetWeaver Application Server ABAP. An authenticated user can exploit it to crash the system or read sensitive memory contents, and it carries a CVSS score of 8.1. In companies that run on SAP, bugs of this kind can disrupt business continuity and the integrity of sensitive data.
SAP SE dominates enterprise software, and SAP NetWeaver is the backbone for business applications at thousands of organizations worldwide. The ABAP stack, including components such as BIC Document, is built into business intelligence and document processing workflows. A vulnerability there hits operational reliability and data confidentiality especially hard.
Technical Information
The vulnerability is triggered when an authenticated user sends a specially crafted request to the BIC Document application. The request manipulates memory address handling, which corrupts memory structures and crashes the target component. Repeated exploit attempts can make the component entirely unavailable, causing a denial of service.
A variant of the crafted request can perform an out-of-bounds read (CWE-125) and expose sensitive information that is in memory at the time of exploitation. The root cause is improper bounds checking and memory management when the BIC Document application processes user-supplied input. An attacker cannot modify information, but the risks of data exposure and service disruption are significant. No public code snippets or PoC details are available for this vulnerability.
Exploitation requires authentication, but no elevated privileges beyond access to the BIC Document functionality. An attacker with valid credentials or a compromised account can use it to disrupt business operations or extract sensitive in-memory data.
Affected Systems and Versions
- SAP NetWeaver Application Server ABAP (BIC Document component)
- No specific version numbers or ranges are provided in public sources
- Only authenticated users with access to BIC Document functionality can exploit this vulnerability
Vendor Security History
SAP has a track record of memory management and authorization vulnerabilities in its ABAP stack. In 2025 alone, multiple high-severity issues have been disclosed, including memory corruption and insecure deserialization flaws. SAP runs a monthly Security Patch Day and generally responds promptly to critical vulnerabilities. SAP environments are complex, though, so vulnerabilities can persist until patches are widely deployed and applied.
