CVE-2026-85919: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft SQL Server 2019 (GDR)

This vulnerability is a heap-based buffer overflow (CWE-122) in Microsoft SQL Server 2019 (GDR) that enables an authorized attacker with local access to escalate privileges. The flaw affects several version ranges across SQL Server 2019 and subsequent releases, specifically versions >=15.0.0 <15.0.2200.2, >=15.0.4003.23 <15.0.4500.2, >=16.0.0 <16.0.1210.3, >=16.0.4003.1 <16.0.4305.5, >=17.0.4006.2 <17.0.5015.4, and >=17.0.1050.2 <17.0.1145.4. The vulnerability has been assigned CVE-2026-85919 and is rated high severity with a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Microsoft has released an official fix for this issue.

An authorized local attacker can exploit this heap-based buffer overflow to elevate their privileges on the affected system. The impact includes potential full compromise of confidentiality, integrity, and availability of the SQL Server instance. There are no known exploits in the wild at this time.

Microsoft has released an official fix for this vulnerability. Users should apply the security updates provided by Microsoft as detailed in their advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85919. Since this is an official fix, applying the patch fully mitigates the vulnerability.