EUVD-2026-100607
GHSA-2wg7-mg75-pgfm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privileged SQL Server account
-
ExploitSend crafted query over network
-
ExecutionTrigger out-of-bounds read in parser
-
ImpactLeak adjacent process memory to attacker
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess high-privilege access to the target SQL Server instance (CVSS PR:H), so this is not reachable by anonymous or low-privileged network users. No user interaction is needed (UI:N) and the vector is network-reachable (AV:N) against a running SQL Server listener, but the high-privilege prerequisite is the key limiting factor. The flaw affects specific builds of SQL Server 2017, 2019, 2022, and 2025 below the patched versions listed in EUVD (e.g., SQL Server 2022 GDR <16.0.1210.3, 2019 GDR <15.0.2200.2, 2017 GDR <14.0.2140.2, 2025 GDR <17.0.1145.4); instances already updated to the patched builds are not affected. Impact is limited to disclosure of in-process memory, with no integrity or availability consequence. |
| Impact | This is a moderate-severity, low-priority issue despite affecting a ubiquitous enterprise product. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, base 4.9) describes a network-reachable out-of-bounds read, but PR:H means the attacker must already hold high privileges on the SQL Server instance, which sharply limits the realistic threat population to insiders or attackers who have already compromised a privileged account. Impact is confined to confidentiality (C:H/I:N/A:N) - memory disclosure only, with no integrity or availability effect. All secondary signals agree on low urgency: CISA SSVC rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. There is no CISA KEV listing and no EPSS score supplied in the input, so quantitative exploitation probability cannot be stated; however, nothing in the data indicates active exploitation or a public exploit. The signals are consistent rather than conflicting: a genuine high-CVSS-category product but a low-real-risk flaw gated behind high privileges. Note one labeling nuance to verify: the CWE is CWE-125 (out-of-bounds read / information disclosure), yet a 'Buffer Overflow' tag is present - treat this as a read-based disclosure, not a memory-corruption/RCE class, when prioritizing. |
| Exploit ScenarioDerived | An attacker who has already obtained high-privilege (e.g., administrative/sysadmin-level) access to a SQL Server instance issues a specially crafted query or request over the network that triggers an out-of-bounds read, causing the server to return adjacent process memory. No public exploit code was identified in the provided data, and CISA SSVC rates exploitation as 'none', so this is a low-likelihood, insider-or-post-compromise scenario rather than mass exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
An out-of-bounds read (CWE-125) in Microsoft SQL Server lets an authenticated attacker who already holds high privileges on the database instance disclose in-process memory contents over the network. The flaw is network-reachable (AV:N) and requires no user interaction (UI:N), but the CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N vector and the vendor's 'authorized attacker' wording confirm the high-privilege prerequisite, so anonymous or low-privileged callers cannot reach it; impact is limited to confidentiality (C:H) with no integrity or availability effect, for an overall base score of 4.9. CISA's SSVC decision framework rates exploitation as 'none' and automatable as 'no', so no public exploit code has been identified at time of analysis, and Microsoft has published vendor-released patches that resolve the affected SQL Server 2017, 2019, 2022, and 2025 builds - making this a moderate-severity, low-priority issue despite the ubiquity of the product.
RemediationAI
Vendor-released patches are available: upgrade to the fixed build for your servicing branch - SQL Server 2022 GDR 16.0.1210.3 or later, SQL Server 2022 CU 16.0.4305.5 or later, SQL Server 2019 GDR 15.0.2200.2 or later, SQL Server 2019 CU 15.0.4500.2 or later, SQL Server 2017 GDR 14.0.2140.2 or later, SQL Server 2017 CU 14.0.3560.2 or later, SQL Server 2025 GDR 17.0.1145.4 or later, and SQL Server 2025 CU 17.0.5015.4 or later; the update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-67628 lists the exact KB packages per branch and build. Note that GDR and CU trains are mutually exclusive update paths on a given instance, so apply the package that matches the branch already installed rather than cross-grading. Because exploitation requires an attacker who already holds high privileges on the instance (PR:H), the most effective compensating controls are entitlement-side: audit and shrink sysadmin, db_owner, CONTROL SERVER, and other elevated role memberships to the minimum required, enforce least-privilege service and application logins, and rotate credentials for any shared high-privilege accounts - the trade-off is operational friction for DBAs and applications that legitimately depend on those rights. Restricting network reachability of the SQL Server TDS endpoint with host firewalls or network segmentation to trusted application subnets reduces the attack surface but does not remediate the flaw and will break legitimate remote clients if scoped too tightly; disabling or firewalling SQL Server Browser and non-essential listeners helps only where those endpoints are not required. There is no configuration switch that disables the vulnerable memory-reading code path, so patching remains the only complete fix, and since the impact is memory disclosure rather than code execution, dropping and recreating any high-privilege session that ran against an unpatched instance after exposure is a prudent containment step.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 8 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-125, Out-of-bounds Read: a buffer or memory region is indexed beyond its allocated bounds, and the out-of-range bytes are returned to the caller rather than handled as an error. In SQL Server this occurs in a code path that processes network-delivered requests, so a high-privileged session (for example a sysadmin or similarly elevated login) can cause the engine to read adjacent in-process memory and reflect portions of it back to the client, resulting in information disclosure of server memory contents. Because the read is only out-of-bounds and not a write, there is no corruption of data or state - the vector's I:N and A:N components reflect that the only consequence is leaked memory. The affected code ships in multiple SQL Server servicing branches tracked by EUVD, covering SQL Server 2017, 2019, 2022, and 2025 in both GDR (security-only) and CU (cumulative update) release trains, which is typical of Microsoft's dual-branch servicing model: GDR builds receive narrowly scoped security fixes on older baselines, while CU builds receive the same fix bundled with feature updates. Because the flaw is reachable over the TDS listener, any instance whose port is exposed to untrusted networks carries additional exposure, though the PR:H requirement substantially narrows the realistic attacker set to insiders, compromised application accounts with elevated rights, or attackers who have already achieved privilege escalation on the host.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Network-reachable (AV:N), low complexity, but requires an existing high-privilege SQL account (PR:H); out-of-bounds read discloses memory so C:H with I:N/A:N.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB