Use of uninitialized resource in Microsoft SQL Server - CVE-2026-67382
Published: November 11, 2026
Vulnerability identifier: #VU165513
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-67382
CWE-ID: CWE-908
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information from SQL Server process memory.
The vulnerability exists due to use of an uninitialized resource in Microsoft SQL Server when handling network requests. A remote user can trigger use of the uninitialized resource to potentially read portions of process memory, including small portions of heap memory.
Affected software
Microsoft SQL Server
How to mitigate CVE-2026-67382
Install security update from vendor's website.
Microsoft SQL Server - addressed in versions 14.0.2150.2, 14.0.3570.2, 15.0.2210.4, 15.0.4510.2, 16.0.1220.3, 16.0.4315.2, 17.0.1155.3, 17.0.5045.3