CVE-2026-67643: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft SQL Server 2022 (CU 26)

This vulnerability (CVE-2026-67643) involves a heap-based buffer overflow in Microsoft SQL Server 2022 (CU 26). It enables an unauthorized attacker to execute arbitrary code remotely without user interaction or privileges. The CVSS 3.1 score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Microsoft has released an official fix for affected versions. No known exploits are reported in the wild at this time.

Successful exploitation allows remote code execution by an unauthenticated attacker, potentially leading to full compromise of the affected SQL Server instance, including confidentiality, integrity, and availability impacts.

An official fix is available from Microsoft. Users should apply the security updates for Microsoft SQL Server 2022 as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-67643. No additional mitigation steps are indicated by the vendor.