EUVD-2026-73809
GHSA-h57r-w39w-33fc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Authenticated low-privilege network access required; heap overflow yields full confidentiality, integrity, and availability compromise with no user interaction or special complexity.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
AnalysisAI
Heap-based buffer overflow in Microsoft SQL Server 2022 enables an authenticated low-privileged network attacker to execute arbitrary code on the database server host. Both the GDR and CU 26 servicing branches of SQL Server 2022 are affected, with Microsoft having released fixed builds in both channels. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid SQL Server account with at minimum low-level privileges - such as a standard read-only database user, application service account, or guest-equivalent login (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H captures the key risk drivers: a low-privileged SQL Server account is sufficient, the attack requires no special complexity or user interaction, and success yields full confidentiality, integrity, and availability compromise of the SQL Server instance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft-released patches immediately: update SQL Server 2022 GDR installations to build 16.0.1200.5 or later, and CU 26 installations to 16.0.4275.2 or later, via the Microsoft Update Catalog, WSUS, or the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78456. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all SQL Server 2022 instances across your environment to identify which runs GDR or CU 26 builds and assess network access patterns to understand authentication exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today