SQL Server Heap Overflow Lets Authenticated Users Run Remote Code

Microsoft SQL Server installations are vulnerable to a high-severity remote code execution flaw. The issue, tracked as CVE-2026-94512, stems from a heap-based buffer overflow. An attacker who has already gained authorization on the system can exploit this weakness. They can then execute arbitrary code over the network. This capability poses a significant risk to database integrity.

How it unfolded

• Microsoft published an advisory detailing the heap-based buffer overflow in SQL Server.
• The National Vulnerability Database assigned a CVSS score of 8.8 to the flaw.
• The weakness is classified under CWE-122 in the Common Weakness Enumeration.

Who is affected

Multiple versions of Microsoft SQL Server are at risk. SQL Server 2017 General Distribution Release builds before 14.0.2140.2 are affected. The 2017 Cumulative Update 31 builds for x64 systems before 14.0.3560.2 are also vulnerable. SQL Server 2019 GDR builds before 15.0.2200.2 face the same threat. The 2019 CU32 builds for x64 systems before 15.0.4500.2 are included. SQL Server 2022 GDR builds before 16.0.1210.3 are affected. The 2022 CU27 builds for x64 systems before 16.0.4305.5 are also at risk.

Our take on the response

The requirement for an authorized attacker limits immediate mass exploitation. However, the potential for remote code execution remains severe. The CVSS score of 8.8 reflects the high impact of a successful breach. Organizations must treat this as a priority for patching. The absence of a public exploit does not guarantee safety. Internal threats or compromised accounts could trigger the overflow.

Who needs to act first

Teams should prioritize systems exposed to internal networks first. Check which database instances run the vulnerable builds listed above. Verify the current patch level against the affected versions. Plan to apply updates during a scheduled maintenance window. Test the patches in a non-production environment before wide deployment. Ensure backups are current before making changes. Monitor logs for unusual activity during the update process.

What to do and how to stay safe: Microsoft

• Identify all SQL Server instances running the affected versions.
• Verify the current build number against the vulnerable list.
• Schedule maintenance windows to apply the necessary updates.
• Monitor system logs for signs of unauthorized access attempts.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-94512?

The National Vulnerability Database rates the vulnerability at 8.8, which is considered high severity.

Which SQL Server versions are affected by this flaw?

Versions 2017, 2019, and 2022 are affected if they are before the specified GDR or CU build numbers.

Can an unauthenticated attacker exploit this vulnerability?

No, the advisory states that an authorized attacker is required to exploit the heap-based buffer overflow.