CVE-2026-68787: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft SQL Server 2017 (CU 31)

This vulnerability is a heap-based buffer overflow in Microsoft SQL Server 2017 and later cumulative updates that enables an attacker with authorized local access to execute arbitrary code. The flaw is identified as CWE-122 and affects specific builds of Microsoft SQL Server versions 14.x, 15.x, 16.x, and 17.x before certain fixed builds. The CVSS 3.1 score is 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. Microsoft has released an official fix to address this issue.

An authorized attacker with local access to the affected Microsoft SQL Server versions can exploit this heap-based buffer overflow to execute arbitrary code with elevated privileges. This can lead to full compromise of the SQL Server instance, affecting confidentiality, integrity, and availability of the database and potentially the host system.

An official fix is available from Microsoft. Users should apply the security updates provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68787 to remediate this vulnerability.