CVE-2026-77484: CWE-502: Deserialization of Untrusted Data in Microsoft Microsoft SQL Server 2019 (CU 32)

This vulnerability (CWE-502) in Microsoft SQL Server 2019 (CU 32) arises from improper handling of deserialization of untrusted data. An attacker with authorized access and network connectivity can exploit this to execute arbitrary code, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 8.8, reflecting high severity with network attack vector, low complexity, and no user interaction required. Multiple version ranges across SQL Server 2019, 2022, and 2024 branches are affected, with fixes released in later builds. Microsoft has published an official advisory with patches to remediate the issue.

Successful exploitation allows an authorized attacker to execute arbitrary code remotely on the affected SQL Server instance, potentially leading to full system compromise including data disclosure, modification, and denial of service. The vulnerability impacts confidentiality, integrity, and availability of the system.

An official fix is available from Microsoft. Users should apply the security updates provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77484 to remediate this vulnerability. No additional mitigations are specified by the vendor.