Heap-based buffer overflow in Microsoft SQL Server - CVE-2026-116938
Published: November 11, 2026
Vulnerability identifier: #VU165001
CSH Severity: Low
CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-116938
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code on the affected SQL Server instance.
The vulnerability exists due to a heap-based buffer overflow in Microsoft SQL Server when handling network requests. A remote user can send specially crafted input over the network to corrupt heap memory and execute arbitrary code.
Exploitation requires XA transactions to already be enabled on the affected SQL Server instance; the exploiting user cannot establish this configuration.
Affected software
Microsoft SQL Server
How to mitigate CVE-2026-116938
Install security update from vendor's website.
Microsoft SQL Server - addressed in versions 14.0.3570.2, 15.0.2210.4, 15.0.4510.2, 16.0.1220.3, 16.0.4315.2, 17.0.1155.3, 17.0.5045.3