Microsoft SQL Server: Heap-based buffer overflow enabling remote code execution
Summary
A heap-based buffer overflow (CWE-122) in Microsoft SQL Server allows an authorized attacker to execute code over the network. The attacker needs a valid low-privilege database login, and the CVSS 3.1 base score is 8.8. A successful attack could fully compromise confidentiality, integrity and availability of the database server.
Affected
- SQL Server 2017 (GDR): 14.0.0 to below 14.0.2150.2
- SQL Server 2017 for x64-based Systems (CU31): 14.0.3006.16 to below 14.0.3570.2
- SQL Server 2019 (GDR): 15.0.0 to below 15.0.2210.4
- SQL Server 2019 for x64-based Systems (CU32): 15.0.4003.23 to below 15.0.4510.2
- SQL Server 2022 (GDR): 16.0.0 to below 16.0.1220.3
- SQL Server 2022 for x64-based Systems (CU27): 16.0.4003.1 to below 16.0.4315.2
- SQL Server 2025 CU10: 17.0.4006.0 to below 17.0.5045.3
- SQL Server 2025 for x64-based Systems (GDR): 17.0.1050.2 to below 17.0.1155.3
Fixed in
- Install the Microsoft update for your branch that is at or above the build number listed in the affected ranges above.
- SQL Server 2025 GDR update of 10 November 2026 (KB5132748) lists this CVE as fixed.
- Confirm exact fixed builds for each branch in the MSRC advisory before patching.
Workaround
Unknown. No vendor workaround has been identified.
- Until patched, restrict which accounts can log in to the database.
- Limit network access to the SQL Server port to trusted hosts only. This is general hardening advice, not a Microsoft recommendation.
Exploitation
- No known exploitation in the wild.
- No public proof of concept known.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- Not listed in the CISA KEV catalog.
Our recommendation
- Identify all SQL Server instances and their exact build numbers.
- Patch affected instances in the next maintenance window, starting with servers reachable from outside the LAN or sharing accounts with other systems.
- Verify fixed builds against the MSRC advisory, as third-party mirrors list some ranges that are not confirmed by Microsoft.
- Remove unused database logins, enforce strong unique passwords and restrict SQL Server port access.
- Monitor for unusual database activity and check for unsupported SQL Server branches.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-116946 msrc.microsoft.com
- CVE Record CVE-2026-116946 (CVE.org) www.cve.org
- KB5132748: SQL Server 2025 GDR update, November 2026 support.microsoft.com
- Strix: CVE-2026-116946 (third-party summary) www.strix.ai
- Threatint: CVE-2026-116946 (third-party summary) cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 22:34.
Original description (NVD)
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.