CVE-2026-67381: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft SQL Server 2017 (CU 31)

This vulnerability (CVE-2026-67381) is a heap-based buffer overflow in Microsoft SQL Server 2017 (CU 31) and later versions, which enables an authorized attacker to elevate privileges remotely over a network. The flaw is identified as CWE-122. The CVSS v3.1 score is 8.8, indicating high severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. Microsoft has published an official fix for affected versions. No known exploits are reported in the wild at this time.

Successful exploitation allows an authorized attacker to elevate their privileges on the affected Microsoft SQL Server instance remotely, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability with high impact ratings.

An official fix is available from Microsoft. Users should apply the security updates provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-67381 to remediate this vulnerability. No additional mitigation steps are indicated by the vendor.