CVE-2026-67629: CWE-125: Out-of-bounds Read in Microsoft Microsoft SQL Server 2017 (CU 31)

This vulnerability (CVE-2026-67629) involves an out-of-bounds read (CWE-125) in Microsoft SQL Server 2017 and later versions, which can be exploited by an authorized attacker to disclose sensitive information over a network. The vulnerability affects various builds of SQL Server versions 14.x, 15.x, 16.x, and 17.x prior to specific fixed builds. The CVSS 3.1 base score is 6.5, with network attack vector, low attack complexity, and requiring privileges but no user interaction. Microsoft has published an official fix for this vulnerability.

An authorized attacker can exploit this out-of-bounds read vulnerability to disclose sensitive information over the network. The vulnerability does not allow for integrity or availability impact, but the confidentiality impact is high. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users should apply the security updates provided by Microsoft for the affected versions of SQL Server to remediate this vulnerability. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-67629 for detailed patch information and update instructions.