SB2026111134 - Multiple vulnerabilities in Microsoft SQL Server
Published: November 11, 2026 Updated: November 11, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 52 vulnerabilities.
1) Heap-based buffer overflow (CVE-ID: CVE-2026-67374)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code on the SQL Server host.
The vulnerability exists due to a heap-based buffer overflow in Microsoft SQL Server when processing specially crafted queries or requests. A remote user can submit a specially crafted query or request over a network connection to trigger memory corruption and execute arbitrary code on the server.
2) Origin validation error (CVE-ID: CVE-2026-118111)
CWE-ID: CWE-346 - Origin Validation Error
CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges and run database commands with elevated privileges.
The vulnerability exists due to an origin validation error in SQL Server when an administrator performs an administrative operation that processes attacker-controlled database content. A remote user can use permissions to create or modify database objects to prepare specially crafted content that, when processed by a separate administrator, allows database commands to run with elevated privileges.
3) Code Injection (CVE-ID: CVE-2026-118112)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute database commands with elevated privileges.
The vulnerability exists due to improper control of code generation in Microsoft SQL Server when an administrative operation processes specially crafted database content. A remote user can create or modify database objects containing this content and have it processed when a separate administrator performs the affected operation to execute database commands with elevated privileges.
4) SQL injection (CVE-ID: CVE-2026-118113)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute database commands with elevated privileges.
The vulnerability exists due to improper neutralization of special elements used in SQL commands in Microsoft SQL Server when an administrator performs an affected administrative operation that processes attacker-controlled database content. A remote user can prepare specially crafted content using permission to create or modify database objects to execute database commands with elevated privileges when a separate administrator performs that operation.
5) SQL injection (CVE-ID: CVE-2026-118114)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges to SQL sysadmin.
The vulnerability exists due to improper neutralization of special elements used in SQL commands in Microsoft SQL Server when processing user-supplied input. A remote user can supply crafted input that alters SQL command execution to gain SQL sysadmin privileges.
Exploitation requires the vulnerable replication feature and topology to be configured on the SQL Server instance. Access to a participating database or replication peer does not allow enabling this configuration through the vulnerability.
6) SQL injection (CVE-ID: CVE-2026-118115)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges to SQL sysadmin in Microsoft SQL Server.
The vulnerability exists due to improper neutralization of special elements used in SQL commands in Microsoft SQL Server when processing user-supplied input. A remote user can supply crafted input over the network to alter SQL commands and gain SQL sysadmin privileges.
Exploitation requires the affected SQL Server instance to have the vulnerable replication feature and topology configured. Access to a participating database or replication peer does not allow this server configuration to be enabled through the vulnerability.
7) SQL injection (CVE-ID: CVE-2026-118116)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges to SQL sysadmin.
The vulnerability exists due to improper neutralization of special elements used in SQL commands in Microsoft SQL Server when processing input used to construct SQL commands. A local user can supply specially crafted input that alters the intended SQL commands to gain SQL sysadmin privileges.
Exploitation requires the vulnerable replication feature and topology to be configured on the affected instance. Access to a participating database or replication peer does not allow this server configuration to be enabled through the vulnerability.
8) SQL injection (CVE-ID: CVE-2026-118117)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges and execute database commands with elevated privileges.
The vulnerability exists due to improper neutralization of special elements used in SQL commands in SQL Server when processing database content during administrative operations. A remote user can use permissions to create or modify database objects to prepare specially crafted content that, when processed by a separate administrator performing the affected operation, causes database commands to execute with elevated privileges.
9) SQL injection (CVE-ID: CVE-2026-118118)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges and execute database commands with elevated privileges.
The vulnerability exists due to improper neutralization of special elements used in SQL commands in Microsoft SQL Server when processing attacker-controlled database content during an administrative operation. A remote user can use permission to create or modify database objects to prepare specially crafted content that a separate administrator processes during the affected operation to execute database commands with elevated privileges.
10) SQL injection (CVE-ID: CVE-2026-118119)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute database commands with elevated privileges.
The vulnerability exists due to improper neutralization of special elements used in SQL commands in Microsoft SQL Server when an administrator performs an administrative operation that processes specially crafted database content. A remote user can prepare this content with permission to create or modify database objects to execute database commands with elevated privileges when a separate administrator performs the affected operation.
11) SQL injection (CVE-ID: CVE-2026-118120)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges and execute database commands beyond the intended replication functionality.
The vulnerability exists due to improper neutralization of special elements in SQL commands in the SQL Server replication functionality when processing requests from users with permission to synchronize a database subscription. A remote user can send a specially crafted request to execute database commands beyond the intended replication functionality and escalate privileges.
12) Out-of-bounds read (CVE-ID: CVE-2026-66813)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to elevate privileges to SYSTEM or SQL sysadmin.
The vulnerability exists due to an out-of-bounds read in Microsoft SQL Server when handling network interactions. A remote attacker can exploit the memory access error over a network to gain elevated privileges in the affected environment.
Successful exploitation requires chaining other vulnerabilities to gain unauthorized access to the target environment.
13) Heap-based buffer overflow (CVE-ID: CVE-2026-67372)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code on an affected SQL Server.
The vulnerability exists due to a heap-based buffer overflow in SQL Server when processing specially crafted queries or requests. A remote user can submit a specially crafted query or request over the network to trigger memory corruption and execute arbitrary code on the server.
14) SQL injection (CVE-ID: CVE-2026-118110)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute database commands with elevated privileges.
The vulnerability exists due to improper neutralization of special elements used in SQL commands in Microsoft SQL Server when processing user-supplied requests. A remote user can send a specially crafted request to an affected service to inject SQL commands and escalate privileges.
15) Stack-based buffer overflow (CVE-ID: CVE-2026-67375)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges to SQL sysadmin or SYSTEM privileges.
The vulnerability exists due to a stack-based buffer overflow in Microsoft SQL Server when handling operations from logged-in users. A remote user can log in to the SQL server with explicit permissions and exploit the overflow to gain SQL sysadmin or SYSTEM privileges.
16) Use of uninitialized resource (CVE-ID: CVE-2026-67382)
CWE-ID: CWE-908 - Use of Uninitialized Resource
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information from SQL Server process memory.
The vulnerability exists due to use of an uninitialized resource in Microsoft SQL Server when handling network requests. A remote user can trigger use of the uninitialized resource to potentially read portions of process memory, including small portions of heap memory.
17) Untrusted Pointer Dereference (CVE-ID: CVE-2026-67387)
CWE-ID: CWE-822 - Untrusted Pointer Dereference
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges to SQL sysadmin or SYSTEM.
The vulnerability exists due to an untrusted pointer dereference in Microsoft SQL Server when handling operations from users connected over a network. A remote user can log in with an account possessing the required explicit permissions and trigger the untrusted pointer dereference to gain SQL sysadmin or SYSTEM privileges.
18) Heap-based buffer overflow (CVE-ID: CVE-2026-67391)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code on the affected SQL Server.
The vulnerability exists due to a heap-based buffer overflow in Microsoft SQL Server when processing user-supplied queries or requests. A remote user can submit a specially crafted query or request over the network to trigger memory corruption and execute arbitrary code on the server.
19) Heap-based buffer overflow (CVE-ID: CVE-2026-67632)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code on the affected SQL Server.
The vulnerability exists due to a heap-based buffer overflow in Microsoft SQL Server when processing user-supplied queries or requests. A remote user can submit a specially crafted query or request over the network to trigger memory corruption and execute arbitrary code on the server.
20) Heap-based buffer overflow (CVE-ID: CVE-2026-67637)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code on an affected SQL Server.
The vulnerability exists due to a heap-based buffer overflow in Microsoft SQL Server when processing user-supplied queries or requests. A remote user can submit a specially crafted query or request over the network to trigger memory corruption and execute arbitrary code on the server.
21) Heap-based buffer overflow (CVE-ID: CVE-2026-67646)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code on an affected Microsoft SQL Server.
The vulnerability exists due to a heap-based buffer overflow in Microsoft SQL Server when processing specially crafted queries or requests. A remote user can submit a specially crafted query or request over a network to trigger memory corruption and execute arbitrary code on the server.
22) Use of uninitialized resource (CVE-ID: CVE-2026-68783)
CWE-ID: CWE-908 - Use of Uninitialized Resource
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information from SQL Server process memory.
The vulnerability exists due to use of an uninitialized resource in Microsoft SQL Server when resources are accessed before initialization. A remote user can interact with the affected server over a network to potentially read portions of process memory.
23) Exposed dangerous method or function (CVE-ID: CVE-2026-84010)
CWE-ID: CWE-749 - Exposed Dangerous Method or Function
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges to SQL sysadmin privileges.
The vulnerability exists due to exposure of a dangerous method or function in Microsoft SQL Server when handling requests over a network. A remote user can invoke the exposed functionality to gain SQL sysadmin privileges.
Only SQL Server instances configured as replication distributors are affected.
24) Heap-based buffer overflow (CVE-ID: CVE-2026-88111)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code on the SQL Server system.
The vulnerability exists due to a heap-based buffer overflow in Microsoft SQL Server when processing input received over a network. A remote user can supply specially crafted input to corrupt heap memory and execute arbitrary code.
25) Heap-based buffer overflow (CVE-ID: CVE-2026-94511)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code on an affected SQL Server instance.
The vulnerability exists due to a heap-based buffer overflow in Microsoft SQL Server when processing network requests. A remote user can send a specially crafted request to execute arbitrary code on the server.
26) Heap-based buffer overflow (CVE-ID: CVE-2026-94513)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to elevate privileges to SYSTEM.
The vulnerability exists due to a heap-based buffer overflow in Microsoft SQL Server when handling network interactions. A remote privileged user can manipulate system components to trigger heap memory corruption and elevate privileges to SYSTEM.
27) Heap-based buffer overflow (CVE-ID: CVE-2026-116942)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code in the SQL Server service context.
The vulnerability exists due to a heap-based buffer overflow in Microsoft SQL Server when handling network requests. A remote user can send a specially crafted request to an affected server to execute arbitrary code in the SQL Server service context.
28) Command injection (CVE-ID: CVE-2026-116930)
CWE-ID: CWE-77 - Command injection
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper neutralization of special elements used in a command in Microsoft SQL Server when a user opens a specially crafted file. A remote attacker can trick a user into opening such a file to inject commands and execute arbitrary code.
29) Heap-based buffer overflow (CVE-ID: CVE-2026-116931)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code on the affected SQL Server instance.
The vulnerability exists due to a heap-based buffer overflow in Microsoft SQL Server when handling network-supplied input. A remote user can submit specially crafted input to corrupt heap memory and execute arbitrary code.
Exploitation requires the vulnerable replication feature and topology to be configured on the SQL Server instance. Access to a participating database or replication peer does not allow this server configuration to be enabled through the vulnerability.
30) Out-of-bounds read (CVE-ID: CVE-2026-116932)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose heap memory from a privileged process running on the server.
The vulnerability exists due to an out-of-bounds read in Microsoft SQL Server when handling network requests. A remote user can trigger a read beyond the bounds of a memory buffer to disclose information from the server's process memory.
31) Heap-based buffer overflow (CVE-ID: CVE-2026-116933)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to execute arbitrary code in the SQL Server service context.
The vulnerability exists due to a heap-based buffer overflow in Microsoft SQL Server when processing database or backup files. A remote privileged user can use database restore or similar administrative permissions to cause the server to process a specially crafted database or backup file over the network to execute arbitrary code in the SQL Server service context.
32) Untrusted Pointer Dereference (CVE-ID: CVE-2026-116934)
CWE-ID: CWE-822 - Untrusted Pointer Dereference
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges in the SQL Server service context.
The vulnerability exists due to untrusted pointer dereference in Microsoft SQL Server when processing requests for an affected database operation. A remote user can send a specially crafted network request with permission to execute that operation to gain elevated privileges in the SQL Server service context.
33) Buffer over-read (CVE-ID: CVE-2026-116935)
CWE-ID: CWE-126 - Buffer over-read
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose heap memory from a privileged process running on the server.
The vulnerability exists due to a buffer over-read in Microsoft SQL Server when handling network input. A remote user can submit specially crafted input to trigger reads beyond a buffer boundary and disclose information from server process memory.
34) Stack-based buffer overflow (CVE-ID: CVE-2026-116936)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to execute arbitrary code in the SQL Server service context.
The vulnerability exists due to a stack-based buffer overflow in Microsoft SQL Server when processing a specially crafted database or backup file. A remote privileged user can use database restore or similar administrative permissions to cause the server to process such a file over the network to execute arbitrary code.
35) Heap-based buffer overflow (CVE-ID: CVE-2026-116937)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code on the affected SQL Server instance.
The vulnerability exists due to a heap-based buffer overflow in Microsoft SQL Server when handling network requests. A remote user can send specially crafted requests to corrupt heap memory and execute arbitrary code.
Exploitation requires XA transactions to already be enabled on the affected SQL Server instance; the exploiting user cannot establish this configuration.
36) Heap-based buffer overflow (CVE-ID: CVE-2026-116938)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code on the affected SQL Server instance.
The vulnerability exists due to a heap-based buffer overflow in Microsoft SQL Server when handling network requests. A remote user can send specially crafted input over the network to corrupt heap memory and execute arbitrary code.
Exploitation requires XA transactions to already be enabled on the affected SQL Server instance; the exploiting user cannot establish this configuration.
37) Out-of-bounds read (CVE-ID: CVE-2026-116939)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information from the heap memory of a privileged process running on the server.
The vulnerability exists due to an out-of-bounds read in Microsoft SQL Server when handling network requests. A remote user can trigger a read beyond the bounds of a memory buffer, in an attack requiring user interaction, to disclose heap memory from a privileged server process.
38) Out-of-bounds read (CVE-ID: CVE-2026-116940)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to disclose heap memory from a privileged process running on the server.
The vulnerability exists due to an out-of-bounds read in Microsoft SQL Server when handling network requests. A remote privileged user can send specially crafted requests that trigger reads beyond valid memory boundaries to disclose heap memory from a privileged process running on the server.
39) Heap-based buffer overflow (CVE-ID: CVE-2026-116941)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code in the SQL Server service context.
The vulnerability exists due to a heap-based buffer overflow in Microsoft SQL Server when processing network requests. A remote user can send a specially crafted request to an affected server to execute arbitrary code in the SQL Server service context.
40) Execution with unnecessary privileges (CVE-ID: CVE-2026-116929)
CWE-ID: CWE-250 - Execution with Unnecessary Privileges
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges to SQL sysadmin privileges.
The vulnerability exists due to execution with unnecessary privileges in Microsoft SQL Server's replication feature when handling operations involving a participating database or replication peer. A remote user can abuse unnecessarily privileged execution through access to a participating database or replication peer to gain SQL sysadmin privileges.
Exploitation requires the vulnerable replication feature and topology to be configured on the SQL Server instance. Access to a participating database or replication peer does not allow this server configuration to be enabled through the vulnerability.
41) Buffer over-read (CVE-ID: CVE-2026-116943)
CWE-ID: CWE-126 - Buffer over-read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information from the heap memory of a privileged process running on the server.
The vulnerability exists due to a buffer over-read in Microsoft SQL Server when processing network input. A remote attacker can supply specially crafted network input to trigger reads beyond a buffer boundary and disclose process memory.
42) Heap-based buffer overflow (CVE-ID: CVE-2026-116944)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to escalate privileges and execute arbitrary code with the privileges of the account running the SQL Server service.
The vulnerability exists due to a heap-based buffer overflow in Microsoft SQL Server when processing network input. A remote privileged user can submit specially crafted input over the network to corrupt heap memory and execute code with the privileges of the SQL Server service account.
The resulting access depends on the permissions assigned to the SQL Server service account.
43) Heap-based buffer overflow (CVE-ID: CVE-2026-116945)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code in the integration service context.
The vulnerability exists due to a heap-based buffer overflow in SQL Server when processing network responses received by an affected integration package. A remote attacker can control a network endpoint used by the package and return a specially crafted response when the package connects to execute arbitrary code in the integration service context.
44) Heap-based buffer overflow (CVE-ID: CVE-2026-116946)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code in the integration service context.
The vulnerability exists due to a heap-based buffer overflow in SQL Server when an affected integration package processes an input file. A remote user can supply a specially crafted file to a package for which they have input permissions to execute arbitrary code in the integration service context.
45) Heap-based buffer overflow (CVE-ID: CVE-2026-116947)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code on the affected SQL Server instance.
The vulnerability exists due to a heap-based buffer overflow in SQL Server when handling network input. A remote user can supply specially crafted input to corrupt heap memory and execute arbitrary code.
Successful exploitation requires the vulnerable replication feature and topology to be configured. Access to a participating database or replication peer does not allow enabling this server configuration through the vulnerability.
46) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2026-118102)
CWE-ID: CWE-327 - Use of a Broken or Risky Cryptographic Algorithm
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information protected by Microsoft SQL Server replication encryption.
The vulnerability exists due to use of a broken or risky cryptographic algorithm in SQL Server replication encryption functionality when protecting replication data. A remote attacker can exploit the cryptographic weakness over a network to disclose sensitive information.
47) Out-of-bounds read (CVE-ID: CVE-2026-118103)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose heap memory from a privileged process running on the server.
The vulnerability exists due to an out-of-bounds read in Microsoft SQL Server when processing network input. A remote attacker can supply crafted input that, with user interaction, causes reads beyond the intended memory boundaries to disclose sensitive information.
48) Use of uninitialized resource (CVE-ID: CVE-2026-118104)
CWE-ID: CWE-908 - Use of Uninitialized Resource
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to use of an uninitialized resource in Microsoft SQL Server when handling network requests. A remote user can trigger use of the uninitialized resource over the network to potentially read small portions of heap memory.
49) SQL injection (CVE-ID: CVE-2026-118105)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges and execute database commands with elevated privileges.
The vulnerability exists due to improper neutralization of special elements used in SQL commands in Microsoft SQL Server when processing user-supplied requests. A remote user can send a specially crafted request to an affected service to inject SQL commands and execute them with elevated privileges.
50) Heap-based buffer overflow (CVE-ID: CVE-2026-118106)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code in the affected SQL Server replication process.
The vulnerability exists due to a heap-based buffer overflow in SQL Server replication when processing data received over an existing replication connection. A remote attacker can supply specially crafted data from a replication peer under their control to execute arbitrary code in the affected replication process.
Exploitation requires the vulnerable replication feature and topology to be configured on the target instance; the vulnerability does not allow a participating database or replication peer to enable this server configuration.
51) Improper Authorization (CVE-ID: CVE-2026-118108)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges and run SQL code with elevated privileges.
The vulnerability exists due to improper authorization in Microsoft SQL Server when handling database operations over a network. A remote user can exploit insufficient authorization checks through access to a participating database or replication peer to run SQL code with elevated privileges.
Exploitation requires the SQL Server instance to have the vulnerable replication feature and topology configured. This configuration cannot be enabled through the vulnerability.
52) SQL injection (CVE-ID: CVE-2026-118109)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges and execute database commands with elevated privileges.
The vulnerability exists due to improper neutralization of special elements used in SQL commands in Microsoft SQL Server when processing user-supplied requests. A remote user can send a specially crafted request to an affected service to inject SQL commands and execute them with elevated privileges.
Remediation
Install update from vendor's website.
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-67374
- https://support.microsoft.com/help/5132749
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-118111
- https://support.microsoft.com/help/5129299
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-118112
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-118113
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-118114
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-118115
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-118116
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-118117
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-118118
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-118119
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-118120
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-66813
- https://support.microsoft.com/help/5129300
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-67372
- https://support.microsoft.com/help/5132748
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-118110
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-67375
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-67382
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-67387
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-67391
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-67632
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-67637
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-67646
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-68783
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-84010
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-88111
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-94511
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-94513
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-116942
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-116930
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-116931
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-116932
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-116933
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-116934
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-116935
- https://support.microsoft.com/help/5132747
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-116936
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-116937
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-116938
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-116939
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-116940
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-116941
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-116929
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-116943
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-116944
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-116945
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-116946
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-116947
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-118102
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-118103
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-118104
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-118105
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-118106
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-118108
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-118109