CVE-2026-67638: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft SQL Server 2025 (CU8)

This vulnerability is a heap-based buffer overflow in Microsoft SQL Server 2025 (CU8) that can be exploited by an authorized attacker to execute arbitrary code remotely over a network. The affected versions include builds from 17.0.0.0 up to but excluding 17.0.4085.5 and from 17.0.1050.2 up to but excluding 17.0.1135.8. The CVSS v3.1 score is 8.8, indicating high impact on confidentiality, integrity, and availability. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

Successful exploitation allows an authorized attacker to execute arbitrary code remotely on the affected Microsoft SQL Server instance, potentially leading to full compromise of the server's confidentiality, integrity, and availability.

An official fix is available from Microsoft. Users should apply the security updates that address this vulnerability as detailed in the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-67638. No additional mitigation steps are indicated by the vendor advisory.