Message Server Heap Overflow: CVE-2026-120010 · CVSS 3.0 7.5 · SAP Note 3805570
The SAP Message Server also speaks HTTP, mostly for monitoring and for logon balancing of browser clients. Note 3805570 fixes a case where it sized a memory allocation incorrectly for certain HTTP requests. As a result, an unauthenticated attacker could trigger a heap buffer overflow. The Message Server would then abort until someone restarts it. SAP rates the Message Server Heap Overflow at CVSS 7.5, High. In this post, we cover exposure, the fix and what to check.
Message Server Heap Overflow: affected kernels
This issue affects kernel 7.22 (including EXT), 7.53, 7.54, 7.77, 7.93 and 9.16 to 9.21. The fix corrects the allocation size. Deploy it through the SP Stack Kernel (SAPEXE.SAR and SAPEXEDB.SAR). Alternatively, if you need it sooner, use the dw.sar hotfix and follow SAP Notes 2083594 and 19466.
Exposure
The Message Server HTTP port is 81nn by default, set by ms/server_port_x or ms/http_port. However, it is often reachable more widely than needed, because some monitoring tools use it. Therefore, restrict it to monitoring hosts and the Web Dispatcher. Since there is no workaround, this network rule is the only interim defence against this issue.
Related notes
Patch the Message Server Heap Overflow together with Notes 3789273 and 3808552. Both fix other Message Server bugs in the same kernel delivery. As a result, one kernel update closes all three.
Why it matters
When the Message Server aborts, new logons and logon group balancing stop for the whole system. In other words, the Message Server Heap Overflow turns one HTTP request into a system-wide outage. So check the port exposure today, even if the kernel update needs a maintenance window.
Message Server Heap Overflow: advisory details
Component: BC-CST-MS
SAP priority: High
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 4
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: SAP Security Note 3805570 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
