Use of uninitialized resource in Microsoft SQL Server - CVE-2026-68783
Published: November 11, 2026
Vulnerability identifier: #VU165520
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-68783
CWE-ID: CWE-908
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information from SQL Server process memory.
The vulnerability exists due to use of an uninitialized resource in Microsoft SQL Server when resources are accessed before initialization. A remote user can interact with the affected server over a network to potentially read portions of process memory.
Affected software
Microsoft SQL Server
How to mitigate CVE-2026-68783
Install security update from vendor's website.
Microsoft SQL Server - addressed in versions 17.0.1155.3, 17.0.5045.3