CVE-2026-67393: CWE-126: Buffer Over-read in Microsoft Microsoft SQL Server 2017 (CU 31)

This vulnerability (CVE-2026-67393) involves a buffer over-read in Microsoft SQL Server 2017 (CU 31) and related versions, which can be exploited by an authorized attacker to disclose sensitive information over a network. The flaw is categorized under CWE-126 (Buffer Over-read). The vulnerability affects various builds of Microsoft SQL Server versions 14.x, 15.x, 16.x, and 17.x prior to the fixed versions provided by Microsoft. The CVSS v3.1 base score is 6.5, indicating medium severity, with network attack vector, low attack complexity, and requiring privileges but no user interaction. Microsoft has released an official fix for this vulnerability.

An authorized attacker can exploit this buffer over-read vulnerability to disclose sensitive information over the network. There is no impact on integrity or availability reported. The vulnerability requires privileges and does not involve user interaction. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected versions of SQL Server to remediate this vulnerability. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-67393 for detailed patch information and update instructions.