PT-2025-41837 · Sap · Abap Platform +1

Published 2025-10-14 · Updated 2025-10-14 · CVE-2025-42902

Positive Technologies · (AI Summary)

CVSS v3.1

5.3

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS ABAP and ABAP Platform (affected versions not specified)

Description A memory corruption issue exists in SAP NetWeaver AS ABAP and ABAP Platform. An unauthenticated attacker can exploit this by sending a corrupted SAP Logon Ticket or SAP Assertion Ticket to the SAP application server. This results in a NULL pointer dereference, causing the work process to crash. The issue has a low impact on availability, with no impact on confidentiality or integrity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2025-42902

Affected Products

Abap Platform

Sap Netweaver As Abap

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-42902 · Security Note
• https://url.sap/sapsecuritypatchday · Note
• https://twitter.com/CVEnew/status/1977903155342950542 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1977959322630979814 · Twitter Post
• https://me.sap.com/notes/3627308 · Note