Out-of-bounds read in Microsoft SQL Server - CVE-2026-66813
Published: November 11, 2026
Vulnerability identifier: #VU165509
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-66813
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to elevate privileges to SYSTEM or SQL sysadmin.
The vulnerability exists due to an out-of-bounds read in Microsoft SQL Server when handling network interactions. A remote attacker can exploit the memory access error over a network to gain elevated privileges in the affected environment.
Successful exploitation requires chaining other vulnerabilities to gain unauthorized access to the target environment.
Affected software
Microsoft SQL Server
How to mitigate CVE-2026-66813
Install security update from vendor's website.
Microsoft SQL Server - addressed in versions 14.0.2150.2, 14.0.3570.2, 15.0.2210.4, 15.0.4510.2, 16.0.1220.3, 16.0.4315.2, 17.0.1155.3, 17.0.5045.3