Executive brief
Microsoft SQL Server contains a heap-based buffer overflow vulnerability that allows an authorized network attacker to execute arbitrary code on the database server. This could enable an attacker with valid database credentials to compromise the server's integrity, access sensitive data stored in the database, and potentially pivot to other systems on the network.
Technical details
A heap-based buffer overflow exists in Microsoft SQL Server that can be triggered by an authenticated attacker over the network. The vulnerability allows an attacker with valid credentials to overflow a heap buffer and achieve remote code execution with the privileges of the SQL Server service account. The attack requires network access to the SQL Server instance and valid authentication credentials. Successful exploitation grants the attacker the ability to execute arbitrary code on the affected system.
Affected products
- Microsoft SQL Server
Timeline
- 2026-09-08: disclosed