Executive brief
Microsoft SQL Server contains a heap-based buffer overflow vulnerability that allows an authorized attacker with network access to execute arbitrary code on the server. This could enable attackers to compromise the database infrastructure, access sensitive corporate data, and potentially pivot to other systems on the network.
Technical details
A heap-based buffer overflow exists in Microsoft SQL Server that can be exploited by an authenticated attacker over the network. The vulnerability results from insufficient bounds checking in memory operations, allowing an attacker to overflow a heap buffer and potentially execute arbitrary code with SQL Server process privileges. Exploitation requires valid SQL Server credentials and network connectivity to the SQL Server instance. An attacker who successfully exploits this vulnerability can achieve remote code execution on the affected system. Patches are available from Microsoft Security Response Center.
Affected products
- Microsoft SQL Server
Timeline
- 2026-09-08: disclosed