EUVD-2026-44254
GHSA-m474-xrpw-p6pj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable stack overflow requiring a low-privilege authorized account (PR:L) with no user interaction and low complexity, yielding full code execution and high CIA impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Stack-based buffer overflow in Microsoft Fabric Data Warehouse allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Fabric Data Warehouse allows an authenticated attacker to run arbitrary code over the network by triggering a stack-based buffer overflow (CWE-121). The flaw carries a CVSS 8.8 rating with high impact to confidentiality, integrity, and availability, and requires only low-privilege access with no user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already possess low-privilege authorized access to the service (CVSS PR:L confirms authentication is needed), and network reachability to the vulnerable Fabric/Service Fabric endpoint (AV:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with full high impact across CIA - a genuinely serious profile for an authenticated attacker. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who already holds a low-privilege authorized account on the Microsoft Fabric/Service Fabric service crafts an oversized or malformed input to a network-exposed endpoint that reaches the vulnerable native routine. The input overflows a fixed-size stack buffer, overwrites the saved return address, and redirects execution to attacker-supplied code, achieving code execution in the service process context. … |
| Remediation | Apply the Microsoft-supplied fix: a patch is available per the vendor advisory (Patch available per vendor advisory) at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56642 - for cloud-hosted Fabric/Service Fabric the mitigation is largely delivered by Microsoft's service updates, while any self-managed Service Fabric clusters should be upgraded to the patched runtime version identified in the MSRC guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Microsoft Fabric Data Warehouse deployments and document users or service accounts with low-privilege access; enable audit logging on administrative and data operations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Service Fabric
View allAn elevation of privilege vulnerability exists in Service Fabric File Store Service under certain conditions, aka 'Servi
Executive Summary An Elevation of Privilege (EOP) vulnerability has been identified within Service Fabric clusters that
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today