CVE-2026-96956: CWE-121: Stack-based Buffer Overflow in Microsoft Microsoft SQL Server 2017 (GDR)

This vulnerability (CVE-2026-96956) is a stack-based buffer overflow in Microsoft SQL Server 2017 (GDR) and later versions, which can be exploited by an authorized attacker over a network to elevate privileges. The issue is tracked under CWE-121. The vulnerability affects multiple version ranges of SQL Server 2017, 2019, 2022, and later, as detailed in the affectedVersions field. Microsoft has published an official fix for this vulnerability as indicated in their security advisory.

Successful exploitation of this vulnerability allows an authorized attacker to elevate privileges on the affected Microsoft SQL Server instances. This can lead to full compromise of the database server, including confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:H/I:H/A:H). No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users should apply the security updates provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96956 to remediate this vulnerability. Since the vulnerability requires an authorized user and network access, applying the patch is the primary recommended mitigation.