Microsoft SQL Server CVE-2026-67631

Exploitation requires network access to a SQL Server 2017, 2019, 2022, or 2025 (x64) instance AND, per Microsoft's 'authorized attacker' language, a valid authenticated session/login to that instance - despite the input vector's PR:N, MSRC 'authorized' phrasing denotes authentication, so an existing database credential is the realistic prerequisite. Limiting factors: successful heap-based buffer overflow exploitation typically demands reliable heap grooming and target-specific offsets (elevating attack complexity), no user interaction is needed, and only patched build thresholds remediate (e.g., 2022 GDR <16.0.1200.5 / CU26 <16.0.4275.2, 2019 GDR <15.0.2190.7, 2017 GDR <14.0.2130.4, 2025 GDR <17.0.1135.8). Instances not network-reachable or requiring credentials the attacker lacks are not exploitable.

Signals conflict and point to a lower real-world priority than the 9.8 headline suggests. The provided CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N (unauthenticated network RCE, C:H/I:H/A:H = 9.8), but the Microsoft description explicitly states an 'authorized attacker,' which is MSRC's standard phrasing for an authenticated actor (PR:L). This PR:N-in-vector vs. 'authorized' contradiction should be resolved against the MSRC advisory before treating this as unauthenticated. EPSS is low at 0.63% (48th percentile), and CISA SSVC scores Exploitation: none and Automatable: no - meaning no observed exploitation and no reliable mass-exploitation path - even though Technical Impact is 'total.' There is no CISA KEV listing and no public exploit code identified. Net: this is a genuinely high-impact memory-corruption RCE in a widely deployed database, but current exploitation signals are quiet and successful attack almost certainly requires an existing SQL Server login plus heap-grooming skill, so it is a patch-in-normal-cycle priority for reachable/exposed instances rather than an emergency.

An attacker who already holds valid credentials (or has compromised an application account) to a reachable SQL Server 2017-2025 instance sends a crafted query or protocol payload that overflows a heap buffer, corrupting adjacent heap structures to hijack execution and run code in the SQL Server service context. No public exploit code has been identified at time of analysis, and the heap overflow likely requires careful grooming (AC:H), so weaponization is non-trivial.