CVE-2026-67378: CWE-822: Untrusted Pointer Dereference in Microsoft Microsoft SQL Server 2019 (CU 32)

This vulnerability, identified as CWE-822 (Untrusted Pointer Dereference), exists in Microsoft SQL Server 2019 (CU 32) and related versions. It allows an attacker without privileges to execute arbitrary code remotely by exploiting improper handling of pointers. The CVSS 3.1 base score is 9.0, indicating critical severity with network attack vector, high complexity, no privileges required, and no user interaction. The vulnerability impacts confidentiality, integrity, and availability. Microsoft has published an official fix addressing this issue.

Successful exploitation enables remote code execution by an unauthorized attacker, potentially leading to full compromise of the affected SQL Server instance. This includes complete control over data confidentiality, integrity, and availability. The vulnerability is critical due to its remote attack vector and high impact on system security.

An official fix is available from Microsoft. Users should apply the security updates provided in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-67378 to remediate this vulnerability. No additional mitigations are specified or required beyond applying the official patch.