Microsoft SQL Server CVE-2026-67384

Authentication is required: the attacker must hold a valid SQL Server login with at minimum low privileges (PR:L per CVSS), such as a guest account, application service account, or any domain account with a SQL login mapped. The SQL Server network listener must be reachable from the attacker's position - direct network access to TCP 1433 (or the configured SQL port) is required. No special database role, schema ownership, or elevated SQL privilege (e.g., sysadmin) is stated as necessary. All four major SQL Server versions (2017, 2019, 2022, 2025) in their unpatched GDR and CU branch builds are vulnerable; the flaw does not appear configuration-dependent. Exploitation is limited by the requirement for a valid credential - unauthenticated external attackers cannot exploit this directly.

CVSS 3.1 scores this at 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - a network-reachable, low-complexity, authenticated-but-low-privilege exploit with full CIA impact. This is a genuinely high-priority vulnerability: the attack complexity is Low, no user interaction is required, and the impact is code execution rather than denial of service or information disclosure. The breadth of affected versions (four major SQL Server releases, eight distinct build branches) substantially widens the exposure surface. No EPSS data was provided in the input and no KEV listing or public PoC exists at time of analysis, which limits urgency slightly for organizations with mature patch cadences, but even a mid-sized municipal IT team in zabrze running SQL Server 2019 or 2022 should treat this as urgent given the low barrier to exploitation once a valid credential is available. The primary limiting factor is the PR:L requirement - an attacker needs a SQL login - but service accounts, leaked credentials, or internal threat actors represent realistic entry points. The absence of KEV and PoC does not imply safety; Microsoft SQL Server is a high-value target and its vulnerabilities are historically weaponized quickly.

An attacker with a valid low-privilege SQL Server login (obtained via credential stuffing, phishing, or internal access) sends a specially crafted query or protocol message that triggers an integer overflow in an internal buffer length calculation, causing a heap-based buffer overflow. The overwritten heap memory allows the attacker to redirect execution flow and run arbitrary code in the context of the SQL Server process - typically running as a service account with significant OS privileges. No public proof-of-concept has been identified at time of analysis.