CVE-2025-42888

MediumCVSS 5.5

Published: 11/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

1th percentile - higher than 1% of all known CVEs

Summary

SAP GUI for Windows may allow a highly privileged user on the affected client PC to locally access sensitive information stored in process memory during runtime. This vulnerability has a high impact on confidentiality, with no impact on integrity and availability.

Risk Assessment

A privileged local user could access sensitive data in memory, potentially leading to information leakage.

Recommendation

Update SAP GUI for Windows to the latest patched version and restrict local privileges.

Other vulnerabilities in SAP GUI for Windows

CVE-2026-24317Medium
SAP GUI for Windows allows DLL files to be loaded from arbitrary directories within the application. An unauthenticated attacker can persuade a victim to place a malicious DLL in one of these directories, and the malicious command executes in the victim's context if GuiXT is enabled.

Original NVD description (English source)

SAP GUI for Windows may allow a highly privileged user on the affected client PC to locally access sensitive information stored in process memory during runtime.This vulnerability has a high impact on confidentiality, with no impact on integrity and availability.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS