Skip to content

CVE-2026-116945 Microsoft SQL Server Remote Code Execution Vulnerability

CriticalCVSS 9.8
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.

Affected products

ProductAffected versionsFixed in
Microsoft sql server 2025 for x64-based systems cu10 < 17.0.5045.3 17.0.5045.3
Microsoft sql server 2022 < 16.0.1220.3 16.0.1220.3
Microsoft sql server 2017 < 14.0.2150.2 14.0.2150.2
microsoft sql server 2022 for x64-based systems cu27 < 16.0.4315.2 16.0.4315.2
microsoft sql server 2019 for x64-based systems cu32 < 15.0.4510.2 15.0.4510.2
Microsoft sql server 2025 < 17.0.1155.3 17.0.1155.3
microsoft sql server 2017 for x64-based systems cu31 < 14.0.3570.2 14.0.3570.2
Microsoft sql server 2019 < 15.0.2210.4 15.0.2210.4
Microsoft SQL Server 2017 (GDR) >= 14.0.0, < 14.0.2150.2 14.0.2150.2
microsoft sql server 2017 for x64-based systems cu31 >= 14.0.3006.16, < 14.0.3570.2 14.0.3570.2
Microsoft SQL Server 2019 (GDR) >= 15.0.0, < 15.0.2210.4 15.0.2210.4
microsoft sql server 2019 for x64-based systems cu32 >= 15.0.4003.23, < 15.0.4510.2 15.0.4510.2
Microsoft SQL Server 2022 (GDR) >= 16.0.0, < 16.0.1220.3 16.0.1220.3
microsoft sql server 2022 for x64-based systems cu27 >= 16.0.4003.1, < 16.0.4315.2 16.0.4315.2
Microsoft SQL Server 2025 CU10 >= 17.0.4006.0, < 17.0.5045.3 17.0.5045.3
Microsoft SQL Server 2025 for x64-based Systems (GDR) >= 17.0.1050.2, < 17.0.1155.3 17.0.1155.3

References