Microsoft SQL Server: Elevation of privilege via stack-based buffer overflow
Summary
A stack-based buffer overflow (CWE-121) in Microsoft SQL Server allows an authorized attacker with high privileges to elevate privileges over the network. The impact on confidentiality, integrity and availability is rated high if the attack succeeds. Attack complexity is high, and no exploitation or public proof of concept has been reported.
Affected
- SQL Server 2017 GDR: 14.0.0 to before 14.0.2140.2
- SQL Server 2017 CU31: 14.0.3006.16 to before 14.0.3560.2
- SQL Server 2019 GDR: 15.0.0 to before 15.0.2200.2
- SQL Server 2019 CU32: 15.0.4003.23 to before 15.0.4500.2
- SQL Server 2022 GDR: 16.0.0 to before 16.0.1210.3
- SQL Server 2022 CU27: 16.0.4003.1 to before 16.0.4305.5
- SQL Server 2025 CU9: 17.0.4006.2 to before 17.0.5015.4
- SQL Server 2025 GDR: 17.0.1050.2 to before 17.0.1145.4
Fixed in
- SQL Server 2017 GDR: KB5128497
- SQL Server 2017 CU31: KB5128496
- SQL Server 2019 GDR: KB5128495
- SQL Server 2019 CU32: KB5128494
- SQL Server 2022 GDR: KB5128493
- SQL Server 2022 CU27: KB5126934
- SQL Server 2025 CU9: KB5126967
- SQL Server 2025 GDR: KB5128492
- Verify KB numbers and fixed builds on the MSRC advisory before rollout.
Workaround
Unknown.
Exploitation
- Not known to be exploited at the time of analysis.
- Not listed in CISA KEV as of 13 October 2026 (not re-checked live).
- Public proof of concept: unknown.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Apply the October 2026 GDR or CU for each SQL Server branch in use, starting with internet-facing or shared instances.
- Inventory all SQL Server instances and their build numbers.
- Review accounts with high privileges and restrict network access to the SQL Server port.
- Plan for a known issue with MSDASQL linked-server queries that use a provider string (error 7416) in the 2019 and 2022 KBs.
- Monitor for unusual privilege changes and database activity.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-96956 msrc.microsoft.com
- KB5128493: SQL Server 2022 GDR (October 2026) support.microsoft.com
- KB5128495: SQL Server 2019 GDR (October 2026) support.microsoft.com
- CVE record mirror with affected ranges (threatint) cve.threatint.com
- SQL Server vulnerabilities overview (kerteszmihaly.com) kerteszmihaly.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:22.
Original description (NVD)
Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.