Stack-based buffer overflow in Microsoft SQL Server - CVE-2026-96956
Published: October 14, 2026
Vulnerability identifier: #VU155780
CSH Severity: Low
CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-96956
CWE-ID: CWE-121
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to escalate privileges to SYSTEM.
The vulnerability exists due to a stack-based buffer overflow in SQL Server when its components are manipulated to trigger a specific condition. A remote privileged user can manipulate system components over a network to escalate privileges to SYSTEM.
Successful exploitation requires a deep understanding of the system and is not guaranteed. Success may depend on the environment, system configuration, and the presence of additional security measures.
Affected software
Microsoft SQL Server
How to mitigate CVE-2026-96956
Install security update from vendor's website.
Microsoft SQL Server - addressed in versions 14.0.2140.2, 14.0.3560.2, 15.0.2200.2, 15.0.4500.2, 16.0.1210.3, 16.0.4305.5, 17.0.1145.4, 17.0.5015.4