IT SBIT Services
Schneeberger
DEEN
CVE tracker

Microsoft SQL Server: Information disclosure via out-of-bounds read

CVE-2026-118103Medium 6.5

← All vulnerabilities

Summary

Microsoft SQL Server contains an out-of-bounds read (CWE-125) that allows an unauthorized attacker to disclose information over the network. The CVSS rating shows high confidentiality impact only, with no integrity or availability impact. Exposure is greatest where the SQL Server port is reachable from the internet or from untrusted networks. The CVSS vector includes user interaction, which should be verified against the MSRC record.

Affected

  • SQL Server 2017 (GDR): 14.0.0 to before 14.0.2150.2
  • SQL Server 2017 for x64-based Systems (CU31): 14.0.3006.16 to before 14.0.3570.2
  • SQL Server 2019 (GDR): 15.0.0 to before 15.0.2210.4
  • SQL Server 2019 for x64-based Systems (CU32): 15.0.4003.23 to before 15.0.4510.2
  • SQL Server 2022 (GDR): 16.0.0 to before 16.0.1220.3
  • SQL Server 2022 for x64-based Systems (CU27): 16.0.4003.1 to before 16.0.4315.2
  • SQL Server 2025 CU10: 17.0.4006.0 to before 17.0.5045.3
  • SQL Server 2025 for x64-based Systems (GDR): 17.0.1050.2 to before 17.0.1155.3

Fixed in

  • SQL Server 2017 GDR: 14.0.2150.2 (KB5132749)
  • SQL Server 2017 CU31: 14.0.3570.2 (KB mapping not confirmed by Microsoft; verify)
  • SQL Server 2019 GDR: 15.0.2210.4 (KB5132751)
  • SQL Server 2019 CU32 GDR: 15.0.4510.2 (KB5132745)
  • SQL Server 2022 GDR: 16.0.1220.3 (KB5132747)
  • SQL Server 2022 CU27 GDR2: 16.0.4315.2 (KB5129300)
  • SQL Server 2025 CU10 GDR: 17.0.5045.3 (KB5129299)
  • SQL Server 2025 GDR: 17.0.1155.3 (KB5132748)

Workaround

Unknown. No vendor workaround identified; the fix is the cumulative update. Generic hardening: restrict SQL Server ports such as 1433 to the application servers that need them.

Exploitation

  • Not known to be exploited in the wild.
  • Rapid7 lists the CVE as Exploitation Less Likely and not publicly disclosed.
  • CISA SSVC: exploitation none, not automatable.
  • No public proof-of-concept found.

Our recommendation

  • Inventory all SQL Server instances and their build numbers.
  • Patch to the fixed builds listed above in the November 2026 update window. The same update also fixes CVE-2026-67646, a SQL Server remote code execution flaw.
  • Confirm the KB article for each instance on the MSRC page before rollout.
  • Restrict network access to the SQL Server port and do not expose it to the internet.
  • Monitor database logs for unusual connections or queries.

Information from Microsoft (Patch Tuesday November 2026)

Severity (Microsoft)
Important
Impact
Information disclosure – SQL Server
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
SQL Server
Updates (KB)
KB5132747, KB5132749, KB5129300, KB5132745, KB5132748, KB5132746

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 12:14.

Original description (NVD)

Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over a network.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed