CVE-2026-68775: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft SQL Server 2017 (CU 31)

This vulnerability (CWE-122) involves a heap-based buffer overflow in Microsoft SQL Server 2017 and later versions up to certain cumulative update builds. It enables an attacker with authorized access to execute arbitrary code remotely over the network. The flaw affects multiple version ranges across SQL Server 2017, 2019, 2022, and 2024, as detailed by the affected version intervals. Microsoft has published an official security update addressing this issue.

Successful exploitation allows an authorized attacker to execute arbitrary code remotely, potentially leading to full compromise of the affected SQL Server instance. The vulnerability impacts confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H). No known exploits in the wild have been reported at this time.

An official fix is available from Microsoft. Users should apply the security updates provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68775 to remediate this vulnerability.