IGS Denial of Service: CVE-2026-109807 · CVE-2026-109806 · CVSS 3.0 7.5 · SAP Note 3809934
Note 3809934 bundles two denial-of-service bugs in the SAP NetWeaver Internet Graphics Service. The first is an out-of-bounds read (CVE-2026-109807). The second, in contrast, is an integer overflow in image data handling (CVE-2026-109806). Both let an unauthenticated user send a request that makes the IGS worker terminate, again and again. Each carries CVSS 7.5, High. In this post, we cover the IGS Denial of Service issue: exposure, the fix and what to check.
IGS Denial of Service: affected releases
The note lists the same IGS releases as Note 3809953: 7.20EXT, 7.20_EX2, 7.53, 7.54, 7.81 and 9.16. The fixes for these bugs add validation of the affected input values. In addition, SAP Note 3843543 has the installation instructions.
Impact in practice
When these bugs keep the workers crashing, charts in BW, SAP GUI and Web Dynpro reports stop rendering. Moreover, some print and export functions fail. The bug does not leak data. Still, it is cheap to trigger once someone can reach the port.
What to do
Patch the IGS Denial of Service bugs together with Note 3809953. Since there is no workaround, limit network access to the IGS HTTP port in the meantime. Usually, only the local application server needs that port. In addition, document the rule, so that later network changes do not open it again.
Monitoring
Meanwhile, watch for repeated IGS worker restarts in the IGS log and in the work directory. Frequent restarts without a clear cause can point to someone probing the IGS Denial of Service bugs. Finally, after patching, confirm the new IGS version on every instance.
IGS Denial of Service: advisory details
Component: BC-FES-IGS
SAP priority: High
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 6
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: SAP Security Note 3809934 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
