Executive brief
Microsoft SQL Server contains a heap-based buffer overflow vulnerability that allows an authenticated user with database access to execute arbitrary code with the privileges of the SQL Server service. This could enable an insider threat or compromised application to gain complete control of the database server and any systems it can access, potentially exposing sensitive business data or disrupting critical database operations.
Technical details
A heap-based buffer overflow exists in SQL Server's memory management during processing of specially crafted input. The vulnerability requires valid database credentials to trigger; an attacker must be authenticated and able to submit SQL queries or commands to the server. By crafting a malicious payload, an authenticated user can overflow the heap buffer and overwrite adjacent memory structures, achieving arbitrary code execution in the context of the SQL Server process. The vendor has released security updates to address this issue.
Affected products
- Microsoft SQL Server
Timeline
- 2026-09-08: disclosed