Untrusted Pointer Dereference in Microsoft SQL Server - CVE-2026-67387
Published: November 11, 2026
Vulnerability identifier: #VU165514
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-67387
CWE-ID: CWE-822
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges to SQL sysadmin or SYSTEM.
The vulnerability exists due to an untrusted pointer dereference in Microsoft SQL Server when handling operations from users connected over a network. A remote user can log in with an account possessing the required explicit permissions and trigger the untrusted pointer dereference to gain SQL sysadmin or SYSTEM privileges.
Affected software
Microsoft SQL Server
How to mitigate CVE-2026-67387
Install security update from vendor's website.
Microsoft SQL Server - addressed in versions 14.0.2150.2, 14.0.3570.2, 15.0.2210.4, 15.0.4510.2, 16.0.1220.3, 16.0.4315.2, 17.0.1155.3, 17.0.5045.3