CVE-2026-88082: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft SQL Server 2019 (GDR)

This vulnerability is a heap-based buffer overflow in Microsoft SQL Server 2019 (GDR) that enables an authorized attacker with local access to elevate their privileges. It affects several version ranges of Microsoft SQL Server 2019 and later releases. The CVSS 3.1 score is 7.0, indicating high severity, with attack vector local, high attack complexity, and requiring low privileges but no user interaction. Microsoft has published an official fix for this vulnerability. There are no known active exploits in the wild. The vendor advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88082.

Successful exploitation allows an authorized local attacker to elevate privileges on the affected system. This could lead to full control of the SQL Server instance and potentially the underlying system, impacting confidentiality, integrity, and availability.

Microsoft has released official patches that address this vulnerability. It is recommended to apply the updates for the affected versions as specified in the vendor advisory. Since this is not a cloud service, remediation depends on applying these patches. No additional mitigation steps are indicated by the vendor advisory.