EUVD-2026-100620
GHSA-vxwq-jqhm-w2r6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privilege SQL Server access
-
ExploitSend input with format-string specifiers
-
ExecutionTrigger CWE-134 in SQL Server
-
ImpactCrash or hang database service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Format string safety
|
| Exploitation Conditions | Exploitation requires the attacker to already hold high privileges on the target SQL Server instance (PR:H) and network reachability to it (AV:N); no user interaction is needed (UI:N) and attack complexity is low (AC:L) once privileged access exists. The limiting factor is the high-privilege prerequisite: an unprivileged or external attacker cannot trigger this without first compromising a privileged database account, confining realistic risk to insiders or post-exploitation scenarios. Affected deployments are SQL Server 2017, 2019, 2022, and 2025 builds below the fixed versions listed in EUVD (e.g., 2022 GDR <16.0.1210.3, 2025 CU9 <17.0.5015.4). |
| Impact | This is a genuinely low-priority issue despite the elevated CVSS metrics for availability. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) scores 4.9 (Medium) and is internally consistent with a denial-of-service: no confidentiality or integrity impact, high availability impact. The critical mitigating factor is PR:H - the attacker must already hold high privileges on the SQL Server instance, which sharply limits the realistic threat population to insiders or attackers who have already compromised a privileged account. CISA SSVC reinforces low priority: Exploitation 'none', Automatable 'no', Technical Impact 'partial'. No EPSS score is provided in the input, there is no CISA KEV listing, and no public exploit is identified, so all signals align toward low real-world risk rather than conflicting. One data-quality conflict exists: the input Tag labels this 'Information Disclosure', but the CVSS vector (C:N/I:N/A:H) and the description ('deny service') both confirm this is an availability/DoS issue, not information disclosure - the tag should not be trusted. |
| Exploit ScenarioDerived | An attacker who has already obtained high-privilege credentials on a SQL Server instance submits input containing externally-controlled format-string specifiers over the network, triggering the CWE-134 flaw and crashing or hanging the database service. No public exploit code has been identified, and the high-privilege prerequisite means this is most plausible as an insider or post-compromise action rather than an initial-access vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Denial of service in Microsoft SQL Server 2017, 2019, 2022, and 2025 can be triggered by a privileged database user (CVSS AV:N/PR:H) who supplies externally-controlled format-string input that crashes the engine, causing availability loss (C:N/I:N/A:H). The high-privilege prerequisite (PR:H) means an unauthenticated or low-privileged attacker cannot reach the vulnerable path, so realistic risk is confined to malicious insiders or post-compromise activity on the database host. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and vendor patches are available; the EPSS-like signals and low CVSS base of 4.9 reinforce that this is a low-priority hardening item rather than an urgent exposure.
RemediationAI
Vendor-released patch: install the fixed build for your servicing branch and generation as identified by EUVD for CVE-2026-94520 - SQL Server 2017 GDR 14.0.2140.2 or CU31 14.0.3560.2; SQL Server 2019 GDR 15.0.2200.2 or CU32 15.0.4500.2; SQL Server 2022 GDR 16.0.1210.3 or CU27 16.0.4305.5; SQL Server 2025 GDR 17.0.1145.4 or CU9 17.0.5015.4 - and verify the applied build with SELECT @@VERSION, following the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-94520 for branch-specific package guidance. Because exploitation requires a high-privileged database principal (PR:H), the most effective compensating control while patch cycles are scheduled is least-privilege enforcement: audit and reduce membership in sysadmin, db_owner, CONTROL SERVER, and ALTER ANY DATABASE roles, revoke direct logins and shared credentials, and monitor for unexpected privileged logons or repeated instance restarts; the trade-off is operational friction for DBAs and any application accounts that legitimately run with elevated rights. If immediate patching is impossible, restrict network reachability to the instance by firewall rules and remove SQL Server exposure to untrusted networks (limiting AV:N attack paths, at the cost of blocking legitimate remote administrative access), and enable crash-dump capture and SQL Server error-log alerting so format-string-induced process terminations are detected quickly - noting that crash-dump analysis is detective, not preventive, and that Always On availability groups or clustering will failover but not prevent the crash itself.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 8 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-134, Use of Externally-Controlled Format String. In this case SQL Server passes attacker-influenced data into a formatting routine that interprets printf-style conversion specifiers (for example %s, %x, and especially %n), letting a caller who reaches the affected code path control how the routine reads or writes memory. Depending on the specifier consumed, the result is memory disclosure or, as scored here (C:N/I:N/A:H), a reliable crash of the SQL Server process and therefore a denial of service against the instance. Microsoft's advisory attributes the report to secure@microsoft.com and lists the vulnerability under SQL Server builds across four generations: SQL Server 2017 (GDR 14.0.0 <14.0.2140.2 and CU31 14.0.3006.16 <14.0.3560.2), SQL Server 2019 (GDR 15.0.0 <15.0.2200.2 and CU32 15.0.4003.23 <15.0.4500.2), SQL Server 2022 (GDR 16.0.0 <16.0.1210.3 and CU27 16.0.4003.1 <16.0.4305.5), and SQL Server 2025 (GDR 17.0.1050.2 <17.0.1145.4 and CU9 17.0.4006.2 <17.0.5015.4), so any instance running a build below the matching fixed version is in scope. Notably, the vendor's own tag for this entry reads 'Information Disclosure' while the scored impact is availability-only; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) and the SSVC rating of Technical Impact: partial indicate the practical worst case is a service crash rather than data compromise or lateral movement.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Network-reachable database service (AV:N/AC:L) but requires an already-high-privilege account (PR:H); impact is service denial only, so C:N/I:N/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB