CVE-2026-67639: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft SQL Server 2017 (CU 31)

This vulnerability (CVE-2026-67639) is a heap-based buffer overflow in Microsoft SQL Server 2017 (CU 31) and related versions. It enables an attacker with authorized access to execute arbitrary code remotely over the network. The flaw affects several builds across SQL Server 2017, 2019, 2022, and newer versions, specifically those versions prior to the fixed builds identified by Microsoft. The vulnerability has a CVSS v3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability. Microsoft has released an official fix to address this issue.

An authorized attacker can exploit this heap-based buffer overflow to execute arbitrary code remotely on the affected SQL Server instances. This can lead to full compromise of the server, including unauthorized data access, modification, or denial of service. The vulnerability impacts confidentiality, integrity, and availability of the system.

An official fix is available from Microsoft. Users should apply the security updates provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-67639 to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.