Microsoft SQL Server: Remote code execution via heap-based buffer overflow

Summary

A heap-based buffer overflow in Microsoft SQL Server allows an authenticated attacker to execute code over the network. The CVE record lists affected builds across the 2017, 2019, 2022 and 2025 branches. A valid database login is required, so exploitation needs an existing foothold, but a successful attack can fully compromise confidentiality, integrity and availability of the database host.

Affected

• Per the official CVE record (CNA: Microsoft):
• SQL Server 2017 (GDR): 14.0.0 to < 14.0.2150.2
• SQL Server 2017 for x64-based Systems (CU31): 14.0.3006.16 to < 14.0.3570.2
• SQL Server 2019 (GDR): 15.0.0 to < 15.0.2210.4
• SQL Server 2019 for x64-based Systems (CU32): 15.0.4003.23 to < 15.0.4510.2
• SQL Server 2022 (GDR): 16.0.0 to < 16.0.1220.3
• SQL Server 2022 for x64-based Systems (CU27): 16.0.4003.1 to < 16.0.4315.2
• SQL Server 2025 CU10: 17.0.4006.0 to < 17.0.5045.3
• SQL Server 2025 for x64-based Systems (GDR): 17.0.1050.2 to < 17.0.1155.3
• Note: the Microsoft advisory could not be retrieved for verification; third-party trackers differ for sibling CVEs.

Fixed in

• Unknown from the CVE record and Microsoft advisory (not retrieved).
• Unverified candidate builds from the September 8, 2026 security updates, not confirmed to fix this CVE:
• SQL Server 2017 GDR: 14.0.2130.4
• SQL Server 2017 CU31: 14.0.3550.4
• SQL Server 2019 GDR: 15.0.2190.7
• SQL Server 2022 GDR: 16.0.1200.5
• SQL Server 2022 CU26: 16.0.4275.2
• SQL Server 2025 GDR: 17.0.1135.8
• A later update batch from October 2026 is reported by a third party and is not verified.

Workaround

• Unknown. No vendor workaround found.
• Restrict network access to SQL Server to trusted application servers.
• Keep SQL Server off the internet and use least-privilege database accounts.

Exploitation

• Unknown. No reports of exploitation in the wild or public proof of concept were found. Check CISA KEV and the MSRC page.

Our recommendation

• Confirm the affected builds and fixed build for CVE-2026-67374 on the MSRC page before rollout.
• Inventory all SQL Server instances and their builds.
• Patch to the Microsoft build for your branch, testing first; the September 2026 update has a reported issue with linked server queries using MSDASQL (error 7416).
• Prioritise internet-facing hosts and servers holding sensitive data.
• Review database accounts and remove unneeded logins.
• Monitor SQL Server logs for unusual logins or activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-67374 msrc.microsoft.com
• Microsoft Security Update Guide: CVE-2026-67373 (sibling CVE) msrc.microsoft.com
• KB5122770: SQL Server 2025 GDR September 2026 support.microsoft.com
• KB5122771: SQL Server 2022 GDR September 2026 support.microsoft.com
• KB5122773: SQL Server 2019 GDR September 2026 support.microsoft.com
• KB5122774: SQL Server 2017 CU31 GDR September 2026 support.microsoft.com
• KB5122768: SQL Server 2022 CU26 GDR September 2026 support.microsoft.com
• Senserva: SQL Server update known issue (KB5122773) senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 21:05.