VulnerabilityDeferred

CVE-2025-42971

A memory corruption vulnerability exists in SAPCAR allowing an attacker to craft malicious SAPCAR archives.

MEDIUM 4.0EPSS 0.14%

Does this matter?

Lower severity and a low EPSS score (0.14%). Track it; it rarely justifies an emergency change on its own.

Description

A memory corruption vulnerability exists in SAPCAR allowing an attacker to craft malicious SAPCAR archives. When a high privileged victim extracts this malicious archive, it gets processed by SAPCAR on their system, resulting in out-of-bounds memory read and write. This could lead to file extraction and file overwrite outside the intended directories. This vulnerability has low impact on the confidentiality, integrity and availability of the application.

CVSS 3.1: 4.0 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
EPSS: 0.14% probability · 4th percentile
CISA KEV: Not listed
Weakness: CWE-787
Source: cna@sap.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.