Microsoft SQL Server: Heap-based buffer overflow leading to privilege escalation

Summary

Microsoft SQL Server 2017, 2019, 2022 and 2025 (GDR and CU builds) contains a heap-based buffer overflow. An attacker with a valid low-privilege SQL login can elevate privileges over the network. Exploitation requires high attack complexity and an existing SQL login, which is common with shared or service accounts. Microsoft fixed the issue in the October 13, 2026 security updates. No exploitation and no public proof of concept are known.

Affected

• SQL Server 2017 (GDR): 14.0.0 to below 14.0.2140.2
• SQL Server 2017 x64 (CU31): 14.0.3006.16 to below 14.0.3560.2 (according to the CVE record)
• SQL Server 2019 (GDR): 15.0.0 to below 15.0.2200.2
• SQL Server 2019 x64 (CU32): 15.0.4003.23 to below 15.0.4500.2
• SQL Server 2022 (GDR): 16.0.0 to below 16.0.1210.3
• SQL Server 2022 x64 (CU27): 16.0.4003.1 to below 16.0.4305.5
• SQL Server 2025 x64 (CU9): 17.0.4006.2 to below 17.0.5015.4
• SQL Server 2025 x64 (GDR): 17.0.1050.2 to below 17.0.1145.4
• SQL Server 2025 CU8: status unverified, treat as affected

Fixed in

• SQL Server 2017 RTM+GDR: 14.0.2140.2 (KB5128497)
• SQL Server 2017 CU31: fixed build unverified, check MSRC or KB5128496
• SQL Server 2019 RTM+GDR: 15.0.2200.2 (KB5128495)
• SQL Server 2019 CU32+GDR: 15.0.4500.2 (KB5128494)
• SQL Server 2022 RTM+GDR: 16.0.1210.3 (KB5128493)
• SQL Server 2022 CU27+GDR1: 16.0.4305.5 (KB5126934)
• SQL Server 2025 RTM+GDR: 17.0.1145.4 (KB5128492)
• SQL Server 2025 CU9+GDR: 17.0.5015.4 (KB5126967)
• SQL Server 2025 CU8: no fix known, move to a supported build

Workaround

Unknown.

• No workaround is documented. Patching is the remedy.
• Interim risk reduction (not from the vendor): restrict who holds SQL logins, remove unused accounts, and limit network access to the SQL port to application servers.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total
• No exploitation in the wild found
• No public proof of concept found
• EPSS score listed by a third party: 0.00389

Our recommendation

• Install the October 2026 security update for your SQL Server version and build.
• Check the KB5128496 or MSRC page for the SQL Server 2017 CU31 fix.
• Move any CU8 instance to a supported build.
• Review SQL logins, remove unused and shared accounts, and restrict SQL port access to application servers.
• Test patches first: KB5126934 notes that sys.dm_exec_requests may raise an access violation and create a dump file while a database is recovering.
• Prioritise servers with many user accounts or shared service accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC advisory CVE-2026-68883 msrc.microsoft.com
• KB5126934 - SQL Server 2022 CU27 security update support.microsoft.com
• KB5128497 - SQL Server 2017 GDR security update support.microsoft.com
• Vulners entry with EPSS and CVSS (third party) vulners.com
• Senserva KB entry on exploitation status (third party) senserva.com
• Strix version cross-check (third party, unverified) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:42.