PT-2025-46240 · Sap · Sap Commoncryptolib

Published 2025-11-11 · Updated 2025-11-16 · CVE-2025-42940

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions SAP CommonCryptoLib (affected versions not specified)

Description SAP CommonCryptoLib does not perform necessary boundary checks during pre-authentication parsing of manipulated ASN.1 data over the network. This can lead to memory corruption and an application crash, impacting availability. There is no impact on confidentiality or integrity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2025-14426

CVE-2025-42940

Affected Products

Sap Commoncryptolib

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-42940 · Security Note
• https://bdu.fstec.ru/vul/2025-14426 · Security Note
• https://twitter.com/VulmonFeeds/status/1988070842819858860 · Twitter Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2025.html · Note
• https://twitter.com/CVEnew/status/1988077270922330487 · Twitter Post
• https://twitter.com/cracbot/status/1990012009510035937 · Twitter Post
• https://url.sap/sapsecuritypatchday · Note
• https://t.me/CVEtracker/36978 · Telegram Post
• https://me.sap.com/notes/3633049 · Note