CVE-2026-67388: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft SQL Server 2017 (CU 31)
Affects Microsoft Microsoft SQL Server 2017 (CU 31)Source CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.9% chance of exploitation in 30 days – higher than 59% of CVEs
- Patch
- Available
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:CWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| MicrosoftMicrosoft SQL Server 2017 (CU 31) | Affected
| Fixed in– |
| MicrosoftMicrosoft SQL Server 2017 (GDR) | Affected
| Fixed in– |
| MicrosoftMicrosoft SQL Server 2019 (CU 32) | Affected
| Fixed in– |
| MicrosoftMicrosoft SQL Server 2019 (GDR) | Affected
| Fixed in– |
| MicrosoftMicrosoft SQL Server 2022 (CU 26) | Affected
| Fixed in– |
| MicrosoftMicrosoft SQL Server 2022 (GDR) | Affected
| Fixed in– |
| MicrosoftMicrosoft SQL Server 2025 (CU8) | Affected
| Fixed in– |
| MicrosoftMicrosoft SQL Server 2025 for x64-based Systems (GDR) | Affected
| Fixed in– |
Mavenmicrosoft/sqlserverpkg:maven/microsoft/sqlserverOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
An official fix is available from Microsoft. Users should apply the security updates provided by Microsoft for the affected versions of SQL Server to remediate this vulnerability. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-67388 for detailed patch information and guidance.
Description
CVE-2026-67388 is a heap-based buffer overflow vulnerability in Microsoft SQL Server 2017 (CU 31) that allows an authorized attacker to execute code remotely over a network. The vulnerability affects multiple versions of Microsoft SQL Server 2017, 2019, 2022, and 2024 builds prior to specific fixed versions. It has a high severity with a CVSS score of 8.8. An official fix is available from Microsoft.
Summary
This vulnerability (CVE-2026-67388) is a heap-based buffer overflow in Microsoft SQL Server 2017 and later versions up to certain builds. It allows an attacker with authorized access to execute arbitrary code remotely over the network. The vulnerability has a CVSS 3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability. Microsoft has released official patches to address this issue. The affected versions include multiple build ranges across SQL Server 2017, 2019, 2022, and 2024 as specified by the version intervals.
Impact
An authorized attacker can exploit this heap-based buffer overflow to execute arbitrary code remotely, potentially leading to full compromise of the affected SQL Server instance. The vulnerability impacts confidentiality, integrity, and availability of the system. There are no known exploits in the wild at this time.
Weaknesses
References
Community reviews
Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.