Heap-based buffer overflow in Microsoft SQL Server - CVE-2026-116944
Published: November 11, 2026
Vulnerability identifier: #VU165007
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-116944
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to escalate privileges and execute arbitrary code with the privileges of the account running the SQL Server service.
The vulnerability exists due to a heap-based buffer overflow in Microsoft SQL Server when processing network input. A remote privileged user can submit specially crafted input over the network to corrupt heap memory and execute code with the privileges of the SQL Server service account.
The resulting access depends on the permissions assigned to the SQL Server service account.
Affected software
Microsoft SQL Server
How to mitigate CVE-2026-116944
Install security update from vendor's website.
Microsoft SQL Server - addressed in versions 14.0.2150.2, 14.0.3570.2, 15.0.2210.4, 15.0.4510.2, 16.0.1220.3, 16.0.4315.2, 17.0.1155.3, 17.0.5045.3