EUVD-2026-73298
GHSA-4259-xrjq-w65p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to SQL Server over network
-
DeliverySend crafted query/request
-
ExploitTrigger untrusted pointer dereference
-
ExecutionRedirect execution flow
-
ImpactExecute code in SQL Server context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Untrusted pointer prevention
|
| Exploitation Conditions | Exploitation requires network reachability to the SQL Server instance (AV:N) plus, despite the vector's PR:N, an 'authorized attacker' per the description - i.e. a valid authenticated SQL Server session is realistically needed to submit the malicious query/request. AC:H indicates the untrusted pointer dereference is not deterministically triggered: the attacker must meet specific memory-state or timing conditions to control the dereferenced pointer. Affected and limited to SQL Server 2019 (before 15.0.4490.9 CU / 15.0.2190.7 GDR), 2022 (before 16.0.4275.2 CU / 16.0.1200.5 GDR), and 2025 (before 17.0.4085.5 / 17.0.1135.8) on x64. No user interaction is required. Limiting factors: authentication, high attack complexity, and the need for an unpatched, network-accessible instance materially reduce realistic exploitability versus the 9.0 headline. |
| Impact | This carries a high vendor CVSS of 9.0 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), but the real-world urgency signals are more moderate. The description states an 'authorized attacker' executes code, which contradicts the PR:N (no privileges) in the vector - a Microsoft-authored CVSS that appears to conflate 'authorized' as post-exploitation code execution while scoring pre-conditions as unauthenticated. This should be treated as authenticated in practice (a valid SQL login is realistically required), which lowers effective risk below the 9.0 headline. Supporting signals align with lower urgency: EPSS is only 0.47% (40th percentile), SSVC reports Exploitation=none and Automatable=no, and there is no CISA KEV listing and no public exploit. The one aggravating factor is SSVC Technical Impact=total plus the vector's S:C and C:H/I:H/A:H, consistent with full code execution in the SQL Server service context. AC:H also indicates the flaw is not trivially triggered. Net: a genuinely serious RCE class flaw in a widely deployed database, but not currently a mass-exploitation emergency - prioritize patching for internet-exposed or multi-tenant SQL Server instances, while noting the PR:N/'authorized attacker' conflict should be verified against Microsoft's MSRC advisory. |
| Exploit ScenarioDerived | An attacker with a valid SQL Server login sends a specially crafted request or query that triggers an untrusted pointer dereference in the database engine, corrupting a pointer the server later dereferences to redirect execution. Because AC:H, the attacker must satisfy specific timing or memory conditions to reliably control the pointer, after which they execute code in the SQL Server process context (S:C, total technical impact). No public proof-of-concept exists at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 17, 2026
Code execution is possible in Microsoft SQL Server 2019, 2022, and 2025 (x64) through an untrusted pointer dereference in the database engine, which an attacker who can reach the instance and submit crafted queries may leverage to run code in the context of the SQL Server service. The vendor rates this 9.0 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), with a scope change indicating the compromise can cross a security boundary, but the practical prerequisites are substantial: the advisory characterizes the actor as an 'authorized attacker', our assessment treats a valid authenticated SQL session as realistically required despite the PR:N vector, and the high attack complexity means the dereferenced pointer is not deterministically controllable. Exploitation signals are currently low - EPSS is 0.47% (40th percentile), CISA SSVC records exploitation as 'none' with automation 'no', and no public exploit code has been identified at time of analysis.
Earlier versions of this analysis (1)
Remote code execution in Microsoft SQL Server allows an authenticated low-privilege attacker to exploit an untrusted pointer dereference (CWE-822) over the network, achieving full compromise of the host with scope change beyond the database engine. Affected instances span SQL Server 2019, 2022, and 2025 across both Cumulative Update and GDR servicing branches. No public exploit code or CISA KEV listing has been identified at time of analysis, though the high complexity rating (AC:H) and scope change (S:C) signal a serious memory corruption primitive when conditions are met.
RemediationAI
Apply the vendor-released patch for CVE-2026-67378 via the Microsoft update guide: SQL Server 2019 CU 32 build 15.0.4490.9 (or GDR build 15.0.2190.7), SQL Server 2022 CU 26 build 16.0.4275.2 (or GDR build 16.0.1200.5), and SQL Server 2025 CU 8 build 17.0.4085.5 (or GDR build 17.0.1135.8); choose the CU or GDR branch that matches your existing servicing track and verify the reported build number after installation. Where patching cannot be completed immediately, the most effective compensating control is reducing the attack surface that reaches the vulnerable engine: block or tightly restrict inbound TCP 1433 (and any non-standard SQL listener ports) to trusted application hosts at the firewall or network security group, which shrinks the population of actors who can even attempt the crafted request but will break connectivity for legitimate remote clients unless paired with an allowlist. Because exploitation realistically requires a valid session, enforce least privilege on SQL logins and application service accounts - revoke unnecessary sysadmin/db_owner rights, disable or rename the sa account, and prefer contained database users or managed identities - accepting that this limits lateral escalation rather than preventing an authenticated attacker from triggering the memory-safety fault. Disabling unused protocols and endpoints (e.g., SQL Browser, xp_cmdshell, and any CLR or OLE Automation surface not required by the workload) removes secondary paths an attacker might use after a partial dereference, at the cost of breaking dependent features. Monitor SQL Server error logs and Windows crash dumps for repeated access-violation faults, as AC:H means successful exploitation attempts may surface first as abnormal process terminations. No public exploit code has been identified at time of analysis and EPSS remains low, so standard patch-cycle prioritization is appropriate, but the 9.0 severity and scope change justify scheduling the update promptly rather than deferring it.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 6 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-822, untrusted pointer dereference: the SQL Server engine follows a pointer derived from data it does not validate, so a crafted request can cause the process to read or write through an attacker-influenced address, which in a native service running with elevated service-account privileges can be escalated from a crash into arbitrary code execution. The scope-changed (S:C) metric in both the vendor vector and our assessment reflects that a successful dereference can escape the SQL Server security context and affect resources outside it, while AC:H reflects that reliably controlling the target address depends on specific memory-layout or timing conditions rather than a simple deterministic request. Affected CPEs cover Microsoft SQL Server 2019, 2022, and 2025 on the x64 platform only, matching the EUVD version matrix for both cumulative-update and GDR servicing branches; SQL Server instances on other platforms or older major versions are not listed. No user interaction is required (UI:N), and the only meaningful friction besides memory-state control is obtaining the authorized session needed to deliver the malicious request.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Network-reachable but the description's 'authorized attacker' means a valid login (PR:L), the pointer-control condition keeps AC:H, and code execution in the DB engine context yields S:C with full C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.
Executive ViewAI
Microsoft SQL Server 2019, 2022, and 2025 (x64) are affected by a critical code execution vulnerability in the database engine. Although no public exploit has been identified and exploitation requires significant prerequisites, a successful attack could allow an attacker to run code with SQL Server service privileges and cross security boundaries, impacting data confidentiality, integrity, and availability. Leadership should prioritize patching because these database platforms often support mission-critical applications and sensitive data.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB