CVE-2026-70189: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft SQL Server 2017 (GDR)

This vulnerability is a heap-based buffer overflow in Microsoft SQL Server 2017 (GDR) that can be exploited by an authorized attacker with high privileges to execute arbitrary code locally. The flaw affects several version ranges of Microsoft SQL Server 2017 and later releases. Microsoft has issued official fixes for the affected versions. The CVSS 3.1 vector indicates local attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

An authorized attacker with high privileges can exploit this heap-based buffer overflow to execute arbitrary code on the affected system locally. This can lead to full compromise of the SQL Server instance, including confidentiality, integrity, and availability impacts. There are no reports of active exploitation in the wild.

Microsoft has released official patches addressing this vulnerability. Users should apply the provided updates for their specific SQL Server versions as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70189. Since an official fix is available, applying the patch is the recommended mitigation.