Microsoft SQL Server: Heap-based buffer overflow allows remote code execution
Summary
A heap-based buffer overflow in Microsoft SQL Server allows an attacker with valid low-privilege credentials to execute code over the network. The CVSS 3.1 base score is 7.5 with high attack complexity, and the impact is rated high for confidentiality, integrity and availability. This is a post-authentication risk, so compromised or weak database accounts and exposed SQL Server ports are the main concern. Affected builds cover the 2017, 2019, 2022 and 2025 branches, both GDR and CU packages.
Affected
- SQL Server 2017 (GDR): 14.0.0 to below 14.0.2150.2
- SQL Server 2017 x64 (CU31): 14.0.3006.16 to below 14.0.3570.2
- SQL Server 2019 (GDR): 15.0.0 to below 15.0.2210.4
- SQL Server 2019 x64 (CU32): 15.0.4003.23 to below 15.0.4510.2
- SQL Server 2022 (GDR): 16.0.0 to below 16.0.1220.3
- SQL Server 2022 x64 (CU27): 16.0.4003.1 to below 16.0.4315.2
- SQL Server 2025 CU10: 17.0.4006.0 to below 17.0.5045.3
- SQL Server 2025 x64 (GDR): 17.0.1050.2 to below 17.0.1155.3
Fixed in
- Fixed in the November 2026 GDR or CU update for each installed branch, per the version ranges above.
- Verify the exact fixed builds on the Microsoft Security Update Guide before patching, as the version ranges were taken from third-party mirrors of the CNA data.
Workaround
Unknown. No separate workaround or mitigation has been published for this CVE.
Exploitation
- Not known to be exploited in the wild.
- Rapid7 rates exploitation as Less Likely.
- Microsoft exploit maturity is reported as Unproven.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Public proof of concept: Unknown.
Our recommendation
- Confirm the installed SQL Server version and branch (GDR or CU).
- Apply the November 2026 GDR or CU update for each installed branch, and patch the whole November 2026 batch.
- Keep SQL Server ports off the internet and restrict access to application servers.
- Review accounts with database access, enforce strong passwords and remove unused logins.
- Monitor database logs for unusual logins and command execution on the database server.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-116931 msrc.microsoft.com
- Strix: CVE-2026-116931 www.strix.ai
- Microsoft KB5132748: SQL Server 2025 November 2026 release support.microsoft.com
- Rapid7: Patch Tuesday November 2026 www.rapid7.com
- OffSeq Radar: SQL Server vulnerabilities fixed radar.offseq.com
- SecurityOnline: SharePoint, SQL Server and Azure DevOps November 2026 securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:44.
Original description (NVD)
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.