Medium severity · published Jul 8, 2025
CVE-2025-42971
Memory Corruption vulnerability in SAPCAR
4.0
CVSS
0.2%
EPSS
No
On KEV
Description
A memory corruption vulnerability exists in SAPCAR allowing an attacker to craft malicious SAPCAR archives. When a high privileged victim extracts this malicious archive, it gets processed by SAPCAR on their system, resulting in out-of-bounds memory read and write. This could lead to file extraction and file overwrite outside the intended directories. This vulnerability has low impact on the confidentiality, integrity and availability of the application.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
SAPCAR · SAP_SE
SAP_CAR 7.53; 7.22EXT · source: vendor
Affected product
SA
SAPCAR
SAP_SE
More from SAPCAR
6.9
CVE-2025-43001
Multiple Privilege Escalation Vulnerabilities in SAPCAR
6.9
CVE-2025-42992
Multiple Privilege Escalation Vulnerabilities in SAPCAR
5.8
CVE-2025-42970
Directory Traversal vulnerability in SAPCAR