Microsoft SQL Server: Remote code execution via heap-based buffer overflow
Summary
A heap-based buffer overflow (CWE-122) in Microsoft SQL Server allows remote code execution over the network. An attacker needs network access and a low-privilege account, such as any SQL login or application service account, and the attack complexity is high. Successful exploitation can lead to full compromise of the database server, and the scope change means the impact may reach beyond SQL Server.
Affected
- SQL Server 2017 GDR: 14.0.0 to before 14.0.2140.2
- SQL Server 2017 CU31 (x64): 14.0.3006.16 to before 14.0.3560.2
- SQL Server 2019 GDR: 15.0.0 to before 15.0.2200.2
- SQL Server 2019 CU32 (x64): 15.0.4003.23 to before 15.0.4500.2
- SQL Server 2022 GDR: 16.0.0 to before 16.0.1210.3
- SQL Server 2022 CU27 (x64): 16.0.4003.1 to before 16.0.4305.5
- SQL Server 2025 CU9 (x64): 17.0.4006.2 to before 17.0.5015.4
- SQL Server 2025 GDR (x64): 17.0.1050.2 to before 17.0.1145.4
- SQL Server 2016 and 2014: Unknown.
Fixed in
- SQL Server 2017 GDR: 14.0.2140.2 (KB5128497)
- SQL Server 2017 CU31: 14.0.3560.2 (KB5128496)
- SQL Server 2019 GDR: 15.0.2200.2 (KB5128495)
- SQL Server 2019 CU32: 15.0.4500.2 (KB5128494)
- SQL Server 2022 GDR: 16.0.1210.3 (KB5128493)
- SQL Server 2022 CU27: 16.0.4305.5 (KB5126934)
- SQL Server 2025 CU9: 17.0.5015.4 (KB5126967)
- SQL Server 2025 GDR: 17.0.1145.4 (KB5128492)
- Fixed builds are taken from secondary sources and must be verified on the MSRC advisory.
Workaround
Unknown. No general workaround is documented. Trace flag 4696 is not a mitigation for this CVE until Microsoft confirms it.
Exploitation
- No evidence of exploitation in the wild found. No CISA KEV entry found at the time of research.
- No public proof-of-concept found.
- EPSS 0.00389 (low exploitation probability).
- A Tenable plugin lists no known exploits, but this is a plugin-level field.
Our recommendation
- Identify all on-premises SQL Server instances and their builds.
- Apply the fixed builds above after verifying them on the MSRC advisory. Test beforehand for the known DMV access-violation issue in SQL Server 2025 CU9.
- Block SQL Server ports (default 1433) from untrusted networks.
- Review SQL logins and service accounts and limit their privileges.
- Monitor for changes in exploitation status, which often follow publication of a proof-of-concept.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-67625 msrc.microsoft.com
- SQL Server 2017 GDR release notes (KB5128497) support.microsoft.com
- SQL Server 2025 CU9 GDR release notes (KB5126967) support.microsoft.com
- Vulners: MS:CVE-2026-67625 vulners.com
- Tenable plugin 365627 www.tenable.com
- CVE record summary (threatint) cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:41.
Original description (NVD)
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.