CVE-2025-42895: SAP HANA JDBC Client HDB_CLIENT 2.0

CVE-2025-42895. CVSS 3.1 base score 6.9 (MEDIUM, Vendor/CNA). EPSS 0.0017 (percentile 0.05914), scored 17-Oct-2026.

Affected technology

SAP HANA JDBC Client · HDB_CLIENT 2.0
SAP_SE

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Local · High privileges required · User interaction required

What an attacker can do

A high-privilege locally authenticated user can supply crafted parameters that lead to unauthorized code loading, resulting in low impact on confidentiality and integrity and high impact on availability of the application. Vendor/CNA’s CVSS 3.1 assessment (base score 6.9/10) rates confidentiality and integrity impact as low; availability impact as high.

Published 18-Oct-2026 22:52 UTC

CWE: CWE-94
CCR priority: 27.6 /100 (P4)
CVSS 3.1: 6.9 /10 · CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:H · Vendor/CNA
EPSS: 0.0017 · percentile 0.05914 · 2026-10-17
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-18 22:50:08.248207+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2025-42895.html