Microsoft SQL Server CVE-2026-67381

Exploitation requires a valid, authenticated SQL Server login at minimum low privilege level (CVSS PR:L). The SQL Server instance must be network-reachable from the attacker - typically TCP/1433 for default instances or dynamically assigned ports for named instances. No special SQL Server feature, non-default configuration, or user interaction is required beyond having a login. Limiting factors: the attacker cannot exploit this from the internet without first obtaining a credential; organizations using Windows Authentication integrated with Active Directory may have a smaller credential exposure surface than those using SQL Authentication with widely distributed passwords. SQL Server 2016 and earlier are not listed in the affected CPE data and appear unaffected.

CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-supported by the description: network-reachable, low complexity, requires only a valid SQL Server login (PR:L), and produces full triad impact. The primary limiting factor is PR:L - an attacker must already possess credentials, ruling out fully unauthenticated exploitation. In practice, SQL Server logins are often widely distributed among application service accounts, developers, and DBAs, so the population of potential attackers is non-trivial in enterprise environments. No EPSS value is provided in the input data; absent KEV listing and POC, real-world exploitation probability must be inferred from the vulnerability class and product footprint alone. Heap overflows in mature database engines are non-trivial to exploit reliably (AC:L in CVSS may be optimistic), but the vendor's own assessment assigns AC:L, which is taken at face value. Risk is real and warrants prompt patching, particularly for internet-facing or multi-tenant SQL Server instances.

An attacker holding a low-privilege SQL Server login - such as a compromised application service account or a developer credential obtained via phishing - connects to the SQL Server instance over the network and submits a specially crafted query or stored-procedure call that triggers the heap-based buffer overflow in the database engine. The corrupted heap memory enables the attacker to overwrite control structures and elevate their effective privileges within SQL Server, potentially reaching sysadmin-level access and gaining full control over all databases and server-level operations. No public exploit code has been identified at time of analysis, but the vulnerability class (CWE-122) is well-understood and exploit development is feasible for skilled researchers.