IGS Memory Corruption: CVE-2026-120008 · CVSS 3.0 8.2 · SAP Note 3809953
The Internet Graphics Service (IGS) renders charts and images for ABAP and Java applications. In addition, it listens on its own HTTP port. Note 3809953 fixes insufficient input validation in an IGS worker. Because of it, a crafted request could write outside an allocated buffer. As a result, an unauthenticated attacker could crash the workers repeatedly or corrupt memory. SAP rates the IGS Memory Corruption at CVSS 8.2, High. In this post, we cover exposure, the fix and what to check.
IGS Memory Corruption: affected releases
The note lists IGS 7.20EXT, 7.20_EX2, 7.53, 7.54, 7.81 and 9.16. The fix for the IGS Memory Corruption hardens input validation. SAP Note 3843543 has the download and installation steps. Note 3809934 also fixes two further IGS denial-of-service bugs this month. Therefore, patch once for both.
Exposure
IGS usually runs as part of the ABAP instance. However, this issue is reachable over its HTTP port. That port (4nn80 by default) is reachable from wherever the application server is. So check whether that port is open to user networks. In most landscapes, only the application server itself needs to talk to IGS.
What to do
Install the patched IGS for each instance. Since there is no workaround, restricting network access to the IGS port is the only interim control against the IGS Memory Corruption. Afterwards, check that charts in BW and Web Dynpro reports still render.
Why a chart service matters
IGS looks like a minor helper. Even so, the IGS Memory Corruption is reachable without credentials, and memory corruption bugs sometimes grow into code execution later. For that reason, include IGS in every patch plan, rather than leaving it behind when the kernel moves forward.
IGS Memory Corruption: advisory details
Component: BC-FES-IGS
SAP priority: High
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Source: SAP Security Note 3809953 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
