This vulnerability (CVE-2026-32176) affects Microsoft SQL Server 2016 Service Pack 3 (GDR) version 13.0.0. It is caused by improper neutralization of special elements used in SQL commands, classified as CWE-89 (SQL Injection). An authorized attacker with local privileges can exploit this flaw to elevate their privileges on the system. The CVSS 3.1 base score is 6.7, indicating a medium severity. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

Successful exploitation allows an authorized local attacker to elevate privileges, potentially gaining higher access rights than intended. The vulnerability impacts confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. It is recommended to apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32176 to remediate this vulnerability.