SB2026090917 - Multiple vulnerabilities in Microsoft SQL Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026090917

SB2026090917 - Multiple vulnerabilities in Microsoft SQL Server

Published: September 9, 2026

Security Bulletin ID SB2026090917
CSH Severity
High
Patch available
YES
Number of vulnerabilities 60
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 5% Medium 52% Low 43%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 60 vulnerabilities.


1) Heap-based buffer overflow (CVE-ID: CVE-2026-68786)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in SQL Server when processing a specially crafted query or request. A remote user can submit a specially crafted query or request to execute arbitrary code.

User interaction is not required.


2) Integer overflow (CVE-ID: CVE-2026-67641)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to integer overflow or wraparound in SQL Server when handling network requests. A remote user can send a crafted network request to cause a denial of service.


3) Heap-based buffer overflow (CVE-ID: CVE-2026-67642)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in SQL Server when processing a specially crafted query or request. A remote user can submit a specially crafted query or request to execute arbitrary code.


4) Heap-based buffer overflow (CVE-ID: CVE-2026-67643)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in SQL Server when processing a specially crafted query or request. A remote user can submit a specially crafted query or request that triggers memory corruption to execute arbitrary code.

User interaction is not required.


5) Out-of-bounds read (CVE-ID: CVE-2026-67645)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in SQL Server when processing network requests. A remote user can trigger the out-of-bounds read to disclose sensitive information.

Successfully exploiting the vulnerability could allow portions of process memory to be read.


6) Use of uninitialized resource (CVE-ID: CVE-2026-67648)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose information.

The vulnerability exists due to use of an uninitialized resource in SQL Server when handling network requests. A remote user can exploit the vulnerability to disclose information.

Disclosed information may include portions of process memory.


7) Heap-based buffer overflow (CVE-ID: CVE-2026-68775)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in SQL Server when processing a specially crafted query or request. A remote user can submit a specially crafted query or request to execute arbitrary code.

User interaction is not required.


8) Use of uninitialized resource (CVE-ID: CVE-2026-68776)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to use of an uninitialized resource in SQL Server when processing network requests. A remote user can exploit the vulnerability to disclose sensitive information.

Successful exploitation could allow reading portions of process memory.


9) Out-of-bounds read (CVE-ID: CVE-2026-68777)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in SQL Server when processing network requests. A remote user can trigger the out-of-bounds read to disclose sensitive information.

Successful exploitation could allow portions of process memory to be read.


10) Out-of-bounds read (CVE-ID: CVE-2026-68778)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose information.

The vulnerability exists due to an out-of-bounds read in SQL Server when handling network requests. A remote user can exploit the out-of-bounds read to disclose information.

Disclosed information may include portions of process memory.


11) Out-of-bounds read (CVE-ID: CVE-2026-68779)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in SQL Server when handling network requests. A remote user can read portions of process memory to disclose sensitive information.


12) Out-of-bounds read (CVE-ID: CVE-2026-68780)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose information.

The vulnerability exists due to an out-of-bounds read in SQL Server when handling network requests. A remote user can send a crafted request to disclose information.

Successful exploitation may allow portions of process memory to be read.


13) Out-of-bounds read (CVE-ID: CVE-2026-68781)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in SQL Server when processing network requests. A remote user can send a specially crafted request to disclose sensitive information.

Successfully exploiting the vulnerability could allow portions of process memory to be read.


14) Out-of-bounds read (CVE-ID: CVE-2026-68784)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in SQL Server when processing network requests. A remote user can read portions of process memory to disclose sensitive information.


15) Heap-based buffer overflow (CVE-ID: CVE-2026-68785)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in SQL Server when handling network requests. A remote privileged user can send a specially crafted network request to execute arbitrary code.


16) Heap-based buffer overflow (CVE-ID: CVE-2026-67639)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in SQL Server when processing specially crafted queries or requests. A remote user can submit a specially crafted query or request to execute arbitrary code.

User interaction is not required.


17) Heap-based buffer overflow (CVE-ID: CVE-2026-68787)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in SQL Server when processing SQL Server input. A local user can trigger the overflow to execute arbitrary code.

Successful exploitation could grant SQL sysadmin privileges.


18) Out-of-bounds read (CVE-ID: CVE-2026-69562)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose information.

The vulnerability exists due to an out-of-bounds read in SQL Server when processing network input. A remote attacker can send network input to the server to disclose information.

User interaction is required for exploitation.


19) Improper access control (CVE-ID: CVE-2026-73028)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to elevate privileges.

The vulnerability exists due to improper access control in SQL Server when logging in to the SQL Server with explicit permissions. A remote user can exploit the vulnerability to elevate their privileges to SQL sysadmin.


20) Buffer over-read (CVE-ID: CVE-2026-73029)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose information.

The vulnerability exists due to a buffer over-read in Microsoft SQL Server when handling network requests. A remote user can send a crafted request to disclose information.

Successful exploitation could expose heap memory from a privileged process running on the server.


21) Insufficient Granularity of Access Control (CVE-ID: CVE-2026-77480)

CWE-ID: CWE-1220 - Insufficient Granularity of Access Control

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to elevate privileges to SQL sysadmin privileges.

The vulnerability exists due to insufficient granularity of access control in SQL Server when logging in to the SQL Server with explicit permissions. A remote user can log in to the SQL Server and elevate privileges to SQL sysadmin.


22) Heap-based buffer overflow (CVE-ID: CVE-2026-77481)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in the SQL Server data-handling API when processing a specially crafted parameter in a CLR (SAFE) stored procedure. A remote user can call the API with a specially crafted parameter to execute arbitrary code.

Exploitation requires the ability to create and execute a CLR (SAFE) stored procedure and does not require user interaction.


23) Heap-based buffer overflow (CVE-ID: CVE-2026-77482)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in SQL Server when processing a malicious server response. A remote attacker can host a malicious server and convince a user to connect to it to execute arbitrary code.

User interaction is required.


24) Weak Authentication (CVE-ID: CVE-2026-77483)

CWE-ID: CWE-1390 - Weak Authentication

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to elevate privileges.

The vulnerability exists due to weak authentication in SQL Server when logging in to the SQL server over a network. A remote user can authenticate with explicit permissions to gain SQL sysadmin privileges.


25) Deserialization of Untrusted Data (CVE-ID: CVE-2026-77484)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to deserialization of untrusted data in SQL Server when processing a specially crafted payload submitted to an affected service. A remote user can submit a specially crafted payload to execute arbitrary code.


26) Use-after-free (CVE-ID: CVE-2026-77485)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to elevate privileges.

The vulnerability exists due to use-after-free in SQL Server when attempting to win a race condition. A local user can exploit the race condition to elevate privileges.

Successful exploitation could grant SYSTEM privileges.


27) Integer overflow (CVE-ID: CVE-2026-77486)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to integer overflow or wraparound in the SQL Server client response-processing functionality when processing a response from a malicious server after a user connects to it. A remote attacker can host a malicious server and convince a user to connect to it to execute arbitrary code.


28) Improper access control (CVE-ID: CVE-2026-77487)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to elevate privileges.

The vulnerability exists due to improper access control in SQL Server when handling logins from users with explicit permissions. A remote user can log in to the SQL Server to elevate privileges.

Successful exploitation can grant SQL sysadmin privileges.


29) Integer underflow (CVE-ID: CVE-2026-77488)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose information.

The vulnerability exists due to integer underflow (wrap or wraparound) in SQL Server when performing integer calculations. A local user can trigger an integer underflow to disclose information.


30) Heap-based buffer overflow (CVE-ID: CVE-2026-78456)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in SQL Server when processing a specially crafted query or request submitted over a network. A remote user can submit a specially crafted query or request to execute arbitrary code.

User interaction is not required.


31) Information Exposure Through an Error Message (CVE-ID: CVE-2026-67383)

CWE-ID: CWE-209 - Information Exposure Through an Error Message

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to generation of error messages containing sensitive information in SQL Server when handling requests over a network. A remote user can trigger an error message containing sensitive information to disclose sensitive information.

Successful exploitation could allow reading portions of process memory.


32) Insufficient Granularity of Access Control (CVE-ID: CVE-2026-66814)

CWE-ID: CWE-1220 - Insufficient Granularity of Access Control

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to elevate privileges.

The vulnerability exists due to insufficient granularity of access control in SQL Server when processing a login from a user with explicit permissions. A remote user can log in to the SQL Server and elevate their privileges to SQL sysadmin.

Exploitation requires explicit permissions on the SQL Server.


33) Insufficient Logging (CVE-ID: CVE-2026-66816)

CWE-ID: CWE-778 - Insufficient Logging

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass the logging of downloaded files.

The vulnerability exists due to insufficient logging in SQL Server when downloading files over a network. A remote user can download files to bypass the logging of downloaded files.


34) Improper privilege management (CVE-ID: CVE-2026-66818)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to elevate privileges.

The vulnerability exists due to improper privilege management in SQL Server when an authorized user logs in to the SQL Server. A remote user can log in with explicit permissions to elevate their privileges to SQL sysadmin privileges.


35) SQL injection (CVE-ID: CVE-2026-66819)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to elevate privileges.

The vulnerability exists due to improper neutralization of special elements used in an SQL command in SQL Server when processing SQL commands. A remote user can log in to the SQL Server and exploit SQL injection to elevate privileges.

Successful exploitation grants SQL sysadmin privileges.


36) SQL injection (CVE-ID: CVE-2026-66820)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to elevate privileges.

The vulnerability exists due to improper neutralization of special elements used in an sql command in SQL Server when processing sql commands. A remote user can log in to the SQL Server with explicit permissions to elevate privileges.

Successful exploitation grants SQL sysadmin privileges.


37) Link following (CVE-ID: CVE-2026-67368)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to elevate privileges.

The vulnerability exists due to improper link resolution before file access in SQL Server when accessing files through links. A remote user can log in to the SQL Server with explicit permissions to elevate privileges to SQL sysadmin.


38) Out-of-bounds read (CVE-ID: CVE-2026-67369)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose information.

The vulnerability exists due to an out-of-bounds read in SQL Server when handling network requests. A remote user can exploit the out-of-bounds read to disclose information.

Successful exploitation could allow portions of process memory to be read.


39) SQL injection (CVE-ID: CVE-2026-67370)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to elevate privileges.

The vulnerability exists due to improper neutralization of special elements used in an SQL command in SQL Server when processing SQL commands. A remote user can log in to the SQL Server with explicit permissions and inject SQL commands to elevate privileges.


40) Heap-based buffer overflow (CVE-ID: CVE-2026-67373)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in SQL Server when processing specially crafted queries or requests. A remote user can submit a specially crafted query or request to execute arbitrary code.


41) Integer overflow (CVE-ID: CVE-2026-67376)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow or wraparound in SQL Server when handling network requests. A remote attacker can send a crafted network request to cause a denial of service.


42) Untrusted Pointer Dereference (CVE-ID: CVE-2026-67378)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to untrusted pointer dereference in SQL Server when processing a specially crafted query or request. A remote user can submit a specially crafted query or request to execute arbitrary code.

Specific protocol settings or configurations must be in place for exploitation to succeed.


43) Stack-based buffer overflow (CVE-ID: CVE-2026-67379)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to a stack-based buffer overflow in SQL Server when processing a specially crafted query or request over a network. A remote user can submit a specially crafted query or request to execute arbitrary code.

Specific protocol settings or configurations must be in place for exploitation to succeed.


44) Heap-based buffer overflow (CVE-ID: CVE-2026-67380)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in SQL Server when processing a specially crafted query or request. A remote user can submit a specially crafted query or request to execute arbitrary code.

User interaction is not required.


45) Heap-based buffer overflow (CVE-ID: CVE-2026-67381)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to elevate privileges.

The vulnerability exists due to a heap-based buffer overflow in SQL Server when logging in to the SQL server over a network. A remote user can log in with explicit permissions to elevate privileges.

Successful exploitation can grant SQL sysadmin privileges.


46) Deserialization of Untrusted Data (CVE-ID: CVE-2026-47297)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to deserialization of untrusted data in SQL Server deserialization functionality when processing untrusted serialized data. A remote attacker can send specially crafted serialized data to execute arbitrary code.

Exploitation requires specific protocol settings or configurations.


47) Integer overflow (CVE-ID: CVE-2026-67384)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to integer overflow or wraparound in SQL Server when processing a specially crafted query or request. A remote user can submit a specially crafted query or request to execute arbitrary code.

User interaction is not required.


48) Use-after-free (CVE-ID: CVE-2026-67385)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to use-after-free in SQL Server when processing a specially crafted query or request. A remote user can submit a specially crafted query or request to execute arbitrary code.

User interaction is not required.


49) Use of uninitialized resource (CVE-ID: CVE-2026-67386)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to use of an uninitialized resource in SQL Server when handling network requests. A remote user can exploit the vulnerability to disclose sensitive information.

Successful exploitation could allow portions of process memory to be read.


50) Heap-based buffer overflow (CVE-ID: CVE-2026-67388)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in SQL Server when processing a specially crafted query or request. A remote user can submit a specially crafted query or request to execute arbitrary code.

User interaction is not required.


51) Out-of-bounds read (CVE-ID: CVE-2026-67389)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in SQL Server when handling network requests. A remote user can send a specially crafted request to disclose sensitive information.

Successful exploitation could allow reading portions of process memory.


52) Buffer over-read (CVE-ID: CVE-2026-67390)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to a buffer over-read in SQL Server when processing network requests. A remote user can send a crafted request to disclose sensitive information.

Successful exploitation could allow reading portions of process memory.


53) Buffer over-read (CVE-ID: CVE-2026-67393)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to a buffer over-read in SQL Server when handling network interactions. A remote user can send network requests to disclose sensitive information.

Successful exploitation could allow portions of process memory to be read.


54) Out-of-bounds read (CVE-ID: CVE-2026-67624)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in SQL Server when processing input. A remote user can exploit the vulnerability to disclose sensitive information.

Successful exploitation could allow portions of process memory to be read.


55) Out-of-bounds read (CVE-ID: CVE-2026-67629)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in SQL Server when processing network requests. A remote user can interact with SQL Server over a network to disclose sensitive information.

Disclosed information may include portions of process memory.


56) Out-of-bounds read (CVE-ID: CVE-2026-67630)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in SQL Server when processing network interactions. A remote user can interact with SQL Server over a network to disclose sensitive information.

Successful exploitation could allow portions of process memory to be read.


57) Heap-based buffer overflow (CVE-ID: CVE-2026-67631)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in SQL Server when processing a specially crafted query or request. A remote user can connect to an affected SQL Server and submit a specially crafted query or request to execute arbitrary code.

User interaction is not required.


58) Out-of-bounds read (CVE-ID: CVE-2026-67633)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in SQL Server when handling network requests. A remote user can send a request to cause a denial of service.


59) Out-of-bounds read (CVE-ID: CVE-2026-67636)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to an out-of-bounds read in SQL Server when processing a specially crafted query or request. A remote user can submit a specially crafted query or request to execute arbitrary code.

Exploitation requires specific protocol settings or configurations, and user interaction is not required.


60) Heap-based buffer overflow (CVE-ID: CVE-2026-67638)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in SQL Server when processing a specially crafted query or request. A remote user can submit a specially crafted query or request that triggers memory corruption to execute arbitrary code.

User interaction is not required.


Remediation

Install update from vendor's website.

References