IT SBIT Services
Schneeberger
DEEN
CVE tracker

Microsoft SQL Server: Elevation of privilege via heap-based buffer overflow

CVE-2026-116944High 7.2

← All vulnerabilities

Summary

A heap-based buffer overflow in Microsoft SQL Server 2017, 2019, 2022 and 2025 allows an attacker to elevate privileges over the network. According to the CVSS vector, the attacker needs high privileges, such as an existing privileged or database login, and no user interaction. Successful exploitation would affect confidentiality, integrity and availability.

Affected

  • Microsoft SQL Server 2017 (GDR): 14.0.0 to before 14.0.2150.2
  • Microsoft SQL Server 2017 for x64-based Systems (CU31): 14.0.3006.16 to before 14.0.3570.2
  • Microsoft SQL Server 2019 (GDR): 15.0.0 to before 15.0.2210.4
  • Microsoft SQL Server 2019 for x64-based Systems (CU32): 15.0.4003.23 to before 15.0.4510.2
  • Microsoft SQL Server 2022 (GDR): 16.0.0 to before 16.0.1220.3
  • Microsoft SQL Server 2022 for x64-based Systems (CU27): 16.0.4003.1 to before 16.0.4315.2
  • Microsoft SQL Server 2025 CU10: 17.0.4006.0 to before 17.0.5045.3
  • Microsoft SQL Server 2025 for x64-based Systems (GDR): 17.0.1050.2 to before 17.0.1155.3

Fixed in

  • SQL Server 2017 GDR: 14.0.2150.2 (KB5132749)
  • SQL Server 2017 CU31: 14.0.3570.2
  • SQL Server 2019 GDR: 15.0.2210.4
  • SQL Server 2019 CU32: 15.0.4510.2 (third-party tracker, not yet confirmed by MSRC)
  • SQL Server 2022 GDR: 16.0.1220.3 (third-party tracker, not yet confirmed by MSRC)
  • SQL Server 2022 CU27: 16.0.4315.2 (third-party tracker, not yet confirmed by MSRC)
  • SQL Server 2025 GDR: 17.0.1155.3 (KB5132748, third-party tracker, not yet confirmed by MSRC)
  • SQL Server 2025 CU10 line: 17.0.5045.3 (third-party tracker, CU name not confirmed)

Workaround

Unknown.

No vendor workaround or mitigation was found in the sources. Confirm on the MSRC Security Update Guide before relying on any interim measure.

Exploitation

  • Rapid7 rates it as Exploitation Less Likely.
  • CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
  • No public proof of concept or exploitation in the wild is known from the sources.
  • Check the CISA KEV catalog before closing this item.

Our recommendation

  • Patch SQL Server to the fixed build for your branch. Verify every build number on the MSRC Security Update Guide first.
  • Restrict SQL Server exposure to the internet and to user subnets.
  • Review accounts with high database privileges and remove shared or unnecessary service accounts.
  • Check whether the same update batch (KB5132749) covers other SQL Server CVEs, such as CVE-2026-67374.

Information from Microsoft (Patch Tuesday November 2026)

Severity (Microsoft)
Important
Impact
Elevation of privilege – SQL Server
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
SQL Server
Updates (KB)
KB5129299, KB5132747, KB5132749, KB5129300, KB5132745, KB5132748

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:47.

Original description (NVD)

Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed