Microsoft SQL Server CVE-2026-88089

Exploitation requires the attacker to already possess high-privilege authenticated access to the SQL Server instance (CVSS PR:H) and local attack vector (AV:L) - remote network exploitation is not indicated. No user interaction is needed (UI:N). The limiting factors are significant: the attacker must be an authorized, elevated principal on the host or within the database engine before the heap-based buffer overflow can be reached, which confines realistic abuse to malicious insiders or post-compromise privilege-leveraging scenarios rather than external unauthenticated attackers. Affected deployments span SQL Server 2017, 2019, 2022, and 2025 builds below the fixed versions listed in EUVD-2026-100618; patched builds (e.g., 15.0.4500.2, 16.0.4305.5, 14.0.3560.2 and corresponding GDR/CU releases) are not vulnerable.

This is a moderate, not top-tier, priority. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N, base 6.7) describes a local-only attack requiring high privileges, which already caps real-world risk - the attacker must already be authenticated with elevated rights on the SQL Server host before anything can happen. CISA's SSVC framework reinforces this: Exploitation is 'none' (no observed or public exploitation) and Automatable is 'no', meaning it cannot be reliably mass-exploited; the only severe signal is Technical Impact 'total'. There is no CISA KEV listing and no public exploit identified, so the signals are internally consistent - high impact but low exploitability. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified. The practical reading: a privilege-constrained, local code-execution bug useful to an already-privileged insider or as a post-compromise step, not a wormable or remotely weaponizable threat. Note the description says 'execute code locally' while the overflow class (heap-based) could in some products be reachable via crafted query input from a lower-privileged session - but the CVSS PR:H explicitly asserts high privileges are required, so treat it as a high-privilege local issue unless Microsoft's advisory states otherwise.

An attacker who already holds high-privilege access to a SQL Server instance (e.g., a rogue or compromised administrative/service account) submits specially crafted input that triggers the heap-based buffer overflow, corrupting memory to execute arbitrary code in the context of the SQL Server process on the local host. No public exploit code has been identified, and exploitation is not automatable per CISA SSVC, so this would require bespoke effort against a specific target.