CVE-2026-85876: CWE-416: Use After Free in Microsoft Microsoft SQL Server 2019 (GDR)

This vulnerability (CVE-2026-85876) involves a use-after-free condition in Microsoft SQL Server 2019 (GDR) that can be exploited by an authorized local attacker to elevate privileges. The flaw affects several version ranges across SQL Server 2019 and subsequent releases, allowing an attacker with limited privileges to gain higher privileges on the system. The CVSS 3.1 vector indicates the attack requires local access with high attack complexity and low privileges, but no user interaction. The impact includes high confidentiality, integrity, and availability consequences. Microsoft has published an official fix for this vulnerability.

An authorized local attacker can exploit this use-after-free vulnerability to elevate their privileges on the affected Microsoft SQL Server instances. This could lead to unauthorized access to sensitive data, modification of data, or disruption of service. The vulnerability has a high severity rating and impacts confidentiality, integrity, and availability.

Microsoft has released an official fix for CVE-2026-85876. Users should apply the security updates provided by Microsoft for the affected versions of SQL Server 2019 and later to remediate this vulnerability. No additional mitigation steps are indicated beyond applying the official patches.