CVE-2026-88088: CWE-190: Integer Overflow or Wraparound in Microsoft Microsoft SQL Server 2019 (GDR)

This vulnerability involves an integer overflow or wraparound condition in Microsoft SQL Server 2019 (GDR). Exploiting this flaw allows an authorized attacker with local access and low privileges to elevate their privileges on the affected system. The vulnerability has been assigned CVE-2026-88088 and is tracked under CWE-190 (Integer Overflow or Wraparound). Multiple version ranges of SQL Server 2019 and subsequent releases are affected. Microsoft has published an official security update to address this issue.

An authorized local attacker can exploit this integer overflow vulnerability to elevate their privileges, potentially gaining higher-level access than intended. The CVSS 3.1 vector indicates high impact on confidentiality, integrity, and availability, but exploitation requires local access and high attack complexity.

An official fix is available from Microsoft. Users should apply the security updates provided by Microsoft as detailed in their advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88088. No additional mitigations are indicated by the vendor advisory.