CVE-2026-67390: CWE-126: Buffer Over-read in Microsoft Microsoft SQL Server 2017 (CU 31)

This vulnerability, identified as CWE-126 (Buffer Over-read), exists in Microsoft SQL Server 2017 and later versions up to certain cumulative update builds. It allows an attacker with authorized access to the SQL Server to cause a buffer over-read condition, potentially leading to unauthorized disclosure of information over the network. The issue does not impact integrity or availability but has a high impact on confidentiality. Microsoft has published an official fix for this vulnerability.

An authorized attacker can exploit this vulnerability to disclose sensitive information over the network. There is no indication of impact on data integrity or system availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users should apply the cumulative updates that address this vulnerability as specified in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-67390. No additional mitigation actions are indicated by the vendor.