EUVD-2026-73317
GHSA-r6qg-cj8h-f89v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain authorized SQL Server access
-
DeliverySend crafted network request/query
-
ExploitTrigger heap-based buffer overflow
-
ExecutionCorrupt heap to hijack control flow
-
ImpactExecute code in SQL Server process context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authorized attacker per Microsoft's description - i.e. a valid SQL Server login or compromised database credentials with network reachability to the engine - despite the published vector's PR:N. The attacker must be able to send crafted requests that reach the vulnerable heap-handling code path in the SQL Server engine. Limiting factors: authentication/authorization to the instance is needed; reliable heap-overflow exploitation for code execution is non-trivial (CISA SSVC marks it non-automatable); and only SQL Server 2022 (builds <16.0.1200.5 GDR / <16.0.4275.2 CU26) and SQL Server 2025 (builds <17.0.1135.8 GDR / <17.0.4085.5 CU8) on x64 are affected. Instances not exposed to untrusted authenticated principals (e.g. tightly network-segmented, single-trusted-app databases) face substantially lower realistic risk. |
| Impact | Vendor CVSS 3.1 rates this 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H), which reads as a fully unauthenticated network RCE - but the description explicitly states an 'authorized attacker,' directly contradicting PR:N. This discrepancy is significant: Microsoft's own text implies authentication/session access is required (PR:L), which would materially lower the true score. The other signals argue AGAINST treating this as a drop-everything emergency: EPSS is only 0.83% (55th percentile), there is no CISA KEV listing, no public POC identified, and CISA SSVC scores Exploitation=none and Automatable=no (only Technical Impact=total). So while the technical impact is severe (heap corruption → code execution with total impact), current real-world exploitation pressure is low and non-automatable. Net: a genuinely serious flaw worth prompt patching on internet-adjacent or multi-tenant SQL Server instances, but the headline 9.8 overstates immediate risk given the authorization requirement in the description and the benign exploitation signals. Verify the true privilege requirement with Microsoft - CVSS PR:N conflicts with the 'authorized attacker' wording. |
| Exploit ScenarioDerived | An attacker who already holds a valid SQL Server login (or has compromised an application's database credentials) sends a specially crafted network request/query that triggers a heap-based buffer overflow in the database engine, corrupting heap memory to achieve arbitrary code execution in the SQL Server process context. No public exploit code is identified at time of analysis, and heap-overflow-to-RCE typically requires non-trivial crafting, so weaponization is not turnkey. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 17, 2026
Heap-based buffer overflow in the Microsoft SQL Server engine (SQL Server 2022 and SQL Server 2025 on x64) can let an attacker corrupt heap memory and potentially achieve code execution under the database service account over a network connection. Microsoft's own description frames the attacker as 'authorized,' meaning a valid SQL Server login or compromised database credentials plus network reachability to the engine are required, and our independent assessment scores the issue as CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H rather than the vendor-published 9.8 (AV:N/AC:L/PR:N/UI:N), which would imply fully unauthenticated remote code execution and contradicts the stated authorization prerequisite. CISA's SSVC evaluation records no exploitation and marks the flaw non-automatable, and no public exploit code has been identified at time of analysis; EPSS is low at 0.83% (55th percentile), though the aggregate C:H/I:H/A:H impact makes prompt patching of exposed instances worthwhile.
Earlier versions of this analysis (1)
Heap-based buffer overflow in Microsoft SQL Server 2022 and 2025 allows a low-privileged, network-authenticated attacker to achieve remote code execution against the database engine. The vulnerability is reachable over the network with low complexity, requiring only a valid SQL Server login - no elevated privileges or user interaction. Patch has been released by Microsoft across both GDR and Cumulative Update servicing branches; no public exploit or CISA KEV listing has been identified at time of analysis.
RemediationAI
Vendor-released patch: apply the corresponding SQL Server update that brings the instance to at least build 16.0.1200.5 (SQL Server 2022 GDR) or 16.0.4275.2 (SQL Server 2022 CU 26), and at least 17.0.1135.8 (SQL Server 2025 GDR) or 17.0.4085.5 (SQL Server 2025 CU 8) - those are the minimum fixed builds implied by the EUVD affected ranges, so confirm the exact KB and build for your branch in Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-67643 before deploying, and note that GDR and CU branches are mutually exclusive (moving between them is a servicing-branch decision, not a simple patch swap, and both must be kept current going forward). Because exploitation is assessed to require an authorized attacker with a valid login, the highest-value compensating controls are credential- and exposure-focused rather than network-perimeter tricks: audit and prune every SQL Server login, remove or disable unused accounts and shared application credentials with excessive privileges, and drop sysadmin/db_owner rights from service and reporting accounts so a single compromised credential cannot reach the vulnerable code path with useful privileges - the trade-off is operational effort in re-permissioning applications, which can break jobs that relied on over-broad rights. Where the instance does not need to be reachable by arbitrary clients, restrict network access to the engine's TCP port (default 1433, plus any configured static or dynamic ports and named-instance endpoints) via host firewall or database firewall rules that allow only known application subnets - this materially shrinks the pool of principals who can send crafted requests, at the cost of added change-management friction for legitimate clients. Disabling unused SQL Server features and protocols (for example SQL Server Browser, unused linked servers, and legacy connectivity) reduces the reachable surface but may break integrations, so test in a staging instance first; finally, since no public exploit code has been identified and the issue is assessed non-automatable, there is no urgent need for emergency network isolation, but instances exposed to untrusted authenticated users should be patched within the normal critical-update window and monitored for unusual memory-related crashes or engine restarts. Avoid generic hardening-only responses as a substitute for the vendor update, because none of the above controls addresses the underlying heap-bounds defect.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a heap-based buffer overflow (CWE-122) inside the Microsoft SQL Server relational engine, reachable through network-facing query/protocol handling rather than through a client-side component. Per the supplied CPE data, only x64 builds of Microsoft SQL Server 2022 (cpe:2.3:a:microsoft:sql_server_2022) and Microsoft SQL Server 2025 (cpe:2.3:a:microsoft:sql_server_2025) are in scope, split across the two servicing branches Microsoft maintains - GDR (security-only) and CU (cumulative update). The root-cause class, CWE-122, means a size or bounds check on a heap-allocated buffer is missing or miscalculated, so attacker-influenced input can write past the end of the allocation, producing memory corruption that may be steerable toward control-flow or data-structure manipulation. Reliable exploitation of a heap overflow for code execution is inherently non-trivial - heap layout, allocator behavior and the ability to place controlled data must all be managed - which is consistent with CISA's SSVC marking of Automatable: none and with our assessment raising attack complexity to High while lowering the privilege requirement from the vendor's PR:N to PR:L. The discrepancies between the vendor vector (AC:L/PR:N) and both Microsoft's own prose ('authorized attacker') and the independent assessment are material: defenders should plan around an authenticated, non-automatable vulnerability rather than an unauthenticated wormable one, while still treating any instance reachable by untrusted or low-privilege logins as high risk.
Know when Sql Server 2022 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description says 'authorized attacker' so PR:L not PR:N; reliable heap-overflow-to-RCE and non-automatable SSVC justify AC:H; successful exploitation yields full C/I/A in the engine process.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
Executive ViewAI
Microsoft SQL Server 2022 and 2025 on x64 are affected by a critical heap-based buffer overflow that could let an authenticated attacker with valid database credentials execute code under the database service account, potentially leading to data theft, integrity loss, or lateral movement. Although no public exploit has been identified at time of analysis and exploitation requires network access plus a valid login, the affected systems often hold sensitive business data, so leadership should prioritize remediation for any internet-facing or high-value instances.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
More in Sql Server 2022
View allSQL Server 2016-2025 contains an improper access control flaw that allows authenticated network attackers to escalate pr
Heap-based buffer overflow in Microsoft SQL Server 2017, 2019, 2022, and 2025 (x64) can be triggered over the network an
Out-of-bounds read in Microsoft SQL Server 2019, 2022, and 2025 on x64 can, under specific memory conditions, be steered
Code execution is possible in Microsoft SQL Server 2019, 2022, and 2025 (x64) through an untrusted pointer dereference i
Microsoft SQL Server Elevation of Privilege Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is rem
Microsoft SQL Server Elevation of Privilege Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is rem
Remote code execution in Microsoft SQL Server 2019, 2022, and 2025 is achievable by an authenticated low-privilege attac
Heap-based buffer overflow in Microsoft SQL Server 2022 enables an authenticated low-privileged network attacker to exec
SQL injection in Microsoft SQL Server enables a low-privileged authenticated attacker to escalate database privileges ov
Privilege escalation in Microsoft SQL Server 2017 through 2025 allows any low-privileged authenticated database user to
Heap-based buffer overflow in Microsoft SQL Server 2017 through 2025 enables an authenticated low-privilege network atta
Remote code execution is possible in Microsoft SQL Server 2017 through 2025 via a heap-based buffer overflow (CWE-122) t
Exploit-DB