Memory Corruption

Why it matters.SAP NetWeaver underpins mission-critical enterprise resource planning, supply chain management, and corporate financial databases globally. When memory corruption vulnerabilities permit unauthenticated remote code execution, attackers compromise entire enterprise operational backbones. Enterprise IT teams must apply SAP kernel corrections across all NetWeaver instances immediately. Security teams should restrict Internet Communication Manager ports from public internet routing.

• Vulnerability mechanics: Tracked as CVE-2026-76964 in security note 3778530, the defect resides in the Internet Communication Manager of NetWeaver AS ABAP.
• Exploit method: Unauthenticated remote attackers send crafted WebSocket control frames with malformed length fields, triggering an out-of-bounds heap write.
• System compromise: Successful exploitation grants remote code execution under the privileges of the system installation user without user interaction.
• Authentication bypass: SAP also resolved CVE-2026-120017 in note 3849308, addressing missing cryptographic verification in SAML2 Service Providers.
• Remediation releases: SAP published security updates across affected NetWeaver kernels, urging teams to patch internet-facing enterprise resource systems immediately.

Why it matters.Web browsers process untrusted remote markup on employee workstations. When an XML parser triggers memory corruption through a freed pointer, malicious websites execute arbitrary code within the browser sandbox. Engineering teams must restart Chrome desktop instances immediately to complete update installation. Administrators should enforce automatic browser restart policies across managed fleets.

• Vulnerability mechanics: Tracked as CVE-2026-125350, the defect is a high-severity use-after-free flaw in Chrome core XML component.
• Exploit status: Google confirmed an active exploit exists in the wild, marking the eighth zero-day patched in Chrome during 2026.
• Affected versions: The flaw impacts Chrome desktop installations across Windows, macOS, and Linux prior to version 157.0.8103.50.
• Remediation releases: Patches rolled out in desktop builds 157.0.8103.50 and 157.0.8103.51 for Windows and macOS, and 157.0.8103.50 for Linux.
• Auxiliary fixes: The release delivers eight additional patches, resolving WebGL memory initialization and GPU boundary write defects.