Executive brief
SQL Server is a widely-used database platform that stores and manages critical business data. A heap-based buffer overflow vulnerability allows attackers on the network to execute arbitrary code on the database server without authentication, potentially leading to complete compromise of all data stored in the database and operational disruption.
Technical details
This is a heap-based buffer overflow vulnerability in Microsoft SQL Server that permits unauthenticated remote code execution. The vulnerability is reachable over the network (network attack vector) and requires no authentication or user interaction to exploit. An attacker can send a specially crafted network packet to trigger the buffer overflow, achieving arbitrary code execution with the privileges of the SQL Server process. A patch from Microsoft is expected via the Security Update Guide referenced in the advisory.
Affected products
- Microsoft SQL Server
Timeline
- 2026-09-08: disclosed