Executive brief
Microsoft SQL Server contains a heap-based buffer overflow vulnerability that allows an authorized network user to execute arbitrary code with elevated privileges. This could enable an attacker with database credentials to compromise the database server and access or manipulate sensitive customer data, disrupt business operations, or pivot to other systems on the network.
Technical details
A heap-based buffer overflow exists in Microsoft SQL Server that can be triggered by an authenticated attacker over the network. The vulnerability allows an attacker with valid credentials to send a specially crafted request that overflows a heap buffer, enabling arbitrary code execution on the server. No user interaction is required beyond the attacker possessing valid database credentials and network access to the SQL Server instance. Successful exploitation grants the attacker code execution in the context of the SQL Server process.
Affected products
- Microsoft SQL Server
Timeline
- 2026-09-08: disclosed