CVE-2026-77486: CWE-190: Integer Overflow or Wraparound in Microsoft Microsoft SQL Server 2017 (CU 31)

This vulnerability involves an integer overflow or wraparound condition in Microsoft SQL Server 2017 (CU 31) that can be exploited by an unauthorized attacker to execute arbitrary code remotely over the network. The flaw affects several versions of Microsoft SQL Server 2017 and 2019 before certain cumulative update builds. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. Microsoft has released an official fix to address this issue.

Successful exploitation allows an attacker to execute arbitrary code remotely on the affected SQL Server instance, potentially leading to full compromise of the database server. The vulnerability impacts confidentiality, integrity, and availability of the system.

An official fix is available from Microsoft. Users should apply the security updates provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77486 to remediate this vulnerability.