CVE-2026-68883: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft SQL Server 2017 (GDR)

This vulnerability (CVE-2026-68883) is a heap-based buffer overflow in Microsoft SQL Server 2017 (GDR) and later versions, which can be exploited by an authorized attacker over a network to elevate privileges. The vulnerability affects several version ranges starting from 14.0.0 up to various fixed versions below 17.0.1145.4. The CVSS 3.1 score is 8.5, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity. Microsoft has issued an official fix for this vulnerability as documented in their security update guide.

Successful exploitation of this heap-based buffer overflow can allow an authorized attacker to elevate their privileges on the affected Microsoft SQL Server instances. This can lead to full compromise of the database server's confidentiality, integrity, and availability. The vulnerability is exploitable remotely over a network but requires low privileges and has a high attack complexity.

An official fix is available from Microsoft. Users should apply the security updates provided by Microsoft for the affected versions of SQL Server 2017 (GDR) and later as referenced in the Microsoft Security Response Center advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68883). No additional mitigation steps are specified beyond applying the official patch.