CVE-2025-42994

SAP MDM Server ReadString function allows an attacker to send specially crafted packets which could trigger a memory read access violation in the server process that would then fail and exit unexpectedly causing high impact on availability with no impact on confidentiality and integrity of the application.

Weakness

The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc().

Potential Mitigations

• Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
• For example, glibc in Linux provides protection against free of invalid pointers.

References

• https://me.sap.com/notes/3610006
• https://url.sap/sapsecuritypatchday