CVE-2026-24320: SAP NetWeaver ABAP Use-After-Free Flaw

CVE-2026-24320 Overview

CVE-2026-24320 is a memory corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP). The flaw stems from improper memory management in the ABAP kernel when converting specially crafted input containing unique characters. An authenticated attacker with low privileges can exploit logical errors in this conversion routine to corrupt memory and potentially leak memory contents. The vulnerability affects the confidentiality of the application but does not impact integrity or availability. The weakness is categorized under [CWE-113] Improper Neutralization of CRLF Sequences and [CWE-787] Out-of-bounds Write.

Critical Impact
Authenticated attackers can trigger memory corruption in the ABAP kernel and read fragments of process memory, leading to limited information disclosure across SAP NetWeaver environments.

Affected Products

SAP NetWeaver AS ABAP Kernel (versions 7.22, 7.54, 7.77, 7.89, 7.93, 9.16, 9.17, 9.18)
SAP NetWeaver AS ABAP krnl64nuc (versions 7.22, 7.22ext)
SAP NetWeaver AS ABAP krnl64uc (version 7.22)

Discovery Timeline

2026-02-10 - CVE-2026-24320 published to NVD
2026-02-17 - Last updated in NVD database

Technical Details for CVE-2026-24320

Vulnerability Analysis

The vulnerability resides in the character conversion logic within the SAP NetWeaver AS ABAP kernel. When the kernel processes user-supplied input containing specific unique characters, the conversion routine miscalculates buffer requirements. This miscalculation produces an out-of-bounds write condition that corrupts adjacent memory regions. The attacker must already hold valid credentials in the SAP system to send the malformed input. Because the vulnerability sits in low-level kernel code shared across multiple ABAP platform versions, both modern (9.x) and legacy (7.22) deployments are affected. The resulting memory corruption can expose residual memory contents to the attacker through application responses.

Root Cause

The defect is a logical error in the character set conversion routine of the ABAP kernel. The routine fails to correctly account for the byte length of certain unique characters during conversion between code pages. This produces an out-of-bounds write [CWE-787] when the converted output exceeds the allocated buffer. Adjacent heap or stack memory is overwritten, and subsequent reads may include uninitialized or stale memory contents in the server response.

Attack Vector

Exploitation requires network access to the SAP NetWeaver Application Server and valid authenticated credentials. The attacker submits a request containing crafted character sequences that trigger the faulty conversion path. The high attack complexity reflects the precise character sequencing and timing required to produce useful memory disclosure. No user interaction is required, and the attack scope remains within the vulnerable component.

No verified proof-of-concept code is publicly available for this vulnerability. Refer to SAP Note #3678313 for vendor-supplied technical details.

Detection Methods for CVE-2026-24320

Indicators of Compromise

Unusual ABAP work process dumps (ST22 short dumps) referencing memory access violations or character conversion errors.
Anomalous response payloads from ABAP endpoints containing non-printable bytes or fragments resembling internal memory structures.
Repeated authenticated requests from a single user submitting payloads with rare or non-standard Unicode code points.

Detection Strategies

Monitor SAP Security Audit Log (SM19/SM20) for repeated abnormal terminations tied to a single user session.
Correlate Web Dispatcher and ICM access logs to identify clients submitting malformed character sequences against ABAP endpoints.
Baseline normal request character distributions and alert on outliers containing rare conversion targets.

Monitoring Recommendations

Forward SAP kernel and audit logs into a centralized analytics platform for cross-session correlation.
Track authentication anomalies for low-privileged accounts that suddenly generate kernel-level errors.
Review developer traces (dev_w* files) for recurring conversion-related failures across application servers.

How to Mitigate CVE-2026-24320

Immediate Actions Required

Apply the SAP-provided kernel patch referenced in SAP Note #3678313 to all affected NetWeaver AS ABAP systems.
Review and restrict authenticated user access to the SAP application server, especially for accounts that do not require interactive use.
Audit recent SAP authentication logs for low-privileged accounts exhibiting unusual request patterns.

Patch Information

SAP released a corrective kernel patch as part of its monthly SAP Security Patch Day. Customers must update the affected ABAP kernel binaries (kernel, krnl64nuc, krnl64uc) according to the version mapping in SAP Note #3678313. Patches must be applied to each application server instance and followed by a kernel restart.

Workarounds

Enforce strict input validation at the SAP Web Dispatcher or reverse proxy layer to filter requests containing unusual character sequences.
Reduce the population of authenticated users on internet-facing NetWeaver systems until the patch is deployed.
Increase logging verbosity on ABAP work processes to capture and investigate conversion-related faults.

bash

# Verify current ABAP kernel patch level on each application server
disp+work -V | grep -E "kernel release|patch number"

# After applying SAP Note #3678313, restart the SAP instance
sapcontrol -nr <instance_nr> -function RestartInstance