Executive brief
Microsoft SQL Server contains an integer overflow vulnerability in its network communication handler that could allow an attacker to execute arbitrary code remotely. This affects database systems used to store and manage critical business data, potentially leading to unauthorized access, data theft, or service disruption.
Technical details
The vulnerability is an integer overflow or wraparound condition in SQL Server's network protocol handling component. An attacker with network access to the SQL Server instance can trigger this overflow by sending specially crafted network packets, bypassing authentication checks and achieving remote code execution. No user interaction or prior authentication is required. The vulnerability has been assigned CVSS 8.8 (high severity) and Microsoft has released patches through the Security Update Guide.
Affected products
- Microsoft SQL Server
Timeline
- 2026-09-08: disclosed