CVE-2026-68785: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft SQL Server 2017 (CU 31)

This vulnerability, identified as CVE-2026-68785 and classified under CWE-122 (heap-based buffer overflow), exists in Microsoft SQL Server 2017 (CU 31) and related versions. It allows an attacker with authorized access to execute code remotely by exploiting a heap overflow condition. The CVSS 3.1 score is 4.9 (medium), with network attack vector, low attack complexity, and requiring high privileges but no user interaction. Microsoft has published an official fix addressing this issue.

Successful exploitation can lead to remote code execution by an authorized attacker, potentially causing denial of service or unauthorized code execution on the affected SQL Server instance. The vulnerability does not impact confidentiality or integrity directly but affects availability. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users should apply the security updates provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68785 to remediate this vulnerability. No additional mitigation actions are indicated by the vendor.