Overview of CVE-2026-116941: Authenticated Heap Overflow Leading to Code Execution in Microsoft SQL Server

Introduction

Microsoft's November 2026 Patch Tuesday included a fix for a heap-based buffer overflow in SQL Server. An authenticated, low-privileged user can send a crafted network request and run code in the SQL Server service context. Four product generations and eight separate servicing paths are affected, so the practical work for database teams is less about understanding the bug and more about matching every instance to the right package and planning around a documented regression.

Microsoft rates CVE-2026-116941 as Important, with a CVSS 3.1 base score of 8.8 (High). The two ratings come from different severity systems, so they do not conflict. At release, Microsoft reported the issue as not publicly disclosed and not exploited, and assessed it as Exploitation Less Likely.

Technical information

Root cause

Microsoft classifies the flaw as CWE 122, a heap-based buffer overflow. MITRE defines this weakness as a write beyond the end of a buffer allocated on the heap. Generically, consequences of this weakness class include crashes or corruption of heap memory that holds function pointers, which can redirect execution. That describes the weakness class in general. Microsoft has not published an exploit implementation or internals for this specific CVE.

SQL Server is closed source, so there is no public commit or diff to examine. Microsoft does not identify the vulnerable function, the request format, the memory layout, or a reproducible payload. The advisory's technical explanation stops at a specially crafted request and the potential code execution outcome.

Attack flow

Based on Microsoft's FAQ, the disclosed sequence is:

1. The attacker holds authenticated, low-privilege access to SQL Server.
2. The attacker sends a specially crafted request to an affected instance over the network.
3. Successful exploitation could execute code in the SQL Server service context. No interaction from another user is required.

Microsoft does not describe the outcome as gaining every operating system privilege. The documented result is code execution with the security context of the SQL Server service account.

CVSS breakdown

The base vector supplied by Microsoft is:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector: Network. The request reaches the server over the network.
• Attack Complexity: Low
• Privileges Required: Low. The attacker needs low-privilege SQL Server access.
• User Interaction: None
• Scope: Unchanged
• Confidentiality, Integrity, Availability: High potential impact for each

Microsoft also publishes a 7.7 temporal score with E:U/RL:O/RC:C. Per the FIRST CVSS v3.1 specification, those values mean Unproven exploit code maturity, an Official Fix ("a complete vendor solution is available"), and Confirmed report confidence. At the time of review, NVD had not added its own assessment, and the record was awaiting enrichment.

Which internal fix is this?

Microsoft does not patch the CVE in isolation. The KB pages for SQL Server 2025 CU10 (KB5129299), 2022 CU27 (KB5129300) and 2017 GDR (KB5132749) each list CVE-2026-116941 alongside roughly 30+ other SQL Server CVEs, and Microsoft does not map internal bug references to CVE IDs. Several entries in the fix tables match the CWE 122 profile:

• "Fixes a heap buffer overflow during XML operation": SQL Server Engine, Programmability, on Linux and Windows, present in the 2025, 2022 and 2017 packages (for example bugs 5622175, 5622178, 5622185).
• Heap buffer overflow in the Log Reader Agent: Replication, Windows (for example 5723117, 5723292, 5723272).
• Buffer overflow when merge replication processes more than 250 WebSync XML nickname entries: Replication, in the 2025 and 2022 packages.

The XML operation fix is a plausible match: it lives in the engine, ships for both platforms, and fits a low-privileged user sending a crafted request. Microsoft has not confirmed this mapping, and it remains our inference. Operationally it makes no difference, because the whole package must be installed and there is no supported way to apply one fix on its own.

Because disclosure is limited, the public information supports version-based remediation but not a payload-specific detection rule or exploit reproduction.

Patch information

Microsoft fixed CVE-2026-116941 in its November 10, 2026 SQL Server security updates. The fix ships only as replacement binaries in cumulative servicing packages.

GDR vs. CU tracks

Each supported version is serviced on two branches, and you need the package matching the branch you are on:

• GDR (General Distribution Release): security and critical fixes only, for servers that have stayed on the RTM baseline.
• CU+GDR: the security fix layered on the latest Cumulative Update, for servers that already take CUs.

Find the row that contains your current version and install that KB:

The updates are cumulative. MSRC states each package also contains earlier servicing releases on its branch, for example the October 2026 GDRs (KB5128492 through KB5128497), so one install brings a server fully current on that branch.

Platforms and installation

• The CU branch packages cover both Windows and Linux. On Linux, the fix arrives by updating the SQL Server packages from the configured Cumulative Update repository.
• On Windows, updates are available through Windows Update or Microsoft Update, the Microsoft Update Catalog, and the Microsoft Download Center.
• Microsoft publishes SHA256 hashes for package integrity checks:
  • SQL Server 2025 KB5129299 x64 installer: 64AC66C63E7037F8578B3C2CB76D093E4E11F5D65951EC5545BE92AF44BEA190
  • SQL Server 2022 KB5129300 x64 installer: 07C854F949CEBA92B43BC08A726AC819545C9CBD11C2B765FF578485FE219F52
  • SQL Server 2017 KB5132749 x64 installer: D5583711DC58E747BD96C521635747D0C59D1255DE94B355A545A472DC541329

To confirm the fix, compare the instance's product version with the fixed build for its branch. For example, 2022 CU27 should report 16.0.4315.2 (file version 2022.160.4315.2). The advisory documents no vulnerability-specific workaround.

Known regression to plan for

The SQL Server 2025 CU10 and 2022 CU27 packages have a documented side effect: querying sys.dm_exec_requests while a database is still recovering can raise an access violation and write a dump file. This can occur during RESTORE, during startup recovery, or before an availability group replica comes online. Microsoft traces it to a code change that references in-memory structures before they are fully initialized. Until a fix ships, Microsoft offers these workarounds:

• Enable trace flag 4696 to opt out of that change. Secondary replica monitoring queries may then return errors 976 and 978 again, as they did before the update.
• Avoid querying that DMV against databases that are recovering.
• Uninstall the update. This also removes the CVE fix, so treat it as a last resort.

If your monitoring tools poll that DMV, test the update on staging availability groups before broad deployment. The regression is a deployment concern. It does not mean the update fails to remediate the CVE.

Affected systems and versions

Microsoft lists SQL Server 2017, 2019, 2022 and 2025 as affected. On every branch, builds below the fixed version are vulnerable. The CVE record's affected intervals run from the lower bound (inclusive) up to, but not including, the fixed build:

The installer applicability ranges in the KB documentation do not match every lower bound in the CVE record, particularly for SQL Server 2025 (for example, KB5132748 applies from 17.0.1000.7). Use the KB documentation to choose the package. KB5129300 applies to SQL Server 2022 on Windows and Linux, all editions.

Exploitation requires authenticated, low-privilege SQL Server access. Any instance on a vulnerable build where such accounts exist falls within scope.

Vendor security history

SQL Server ranks third in the November 2026 DB Engines ranking with a score of 693.53. DB Engines measures popularity, not installations or market share, so the ranking indicates prominence rather than exposure counts.

The product has a well-documented history of memory safety issues. A Microsoft bulletin published July 24, 2002 described SQL Server 2000 Resolution Service vulnerabilities reachable through UDP port 1434, where crafted packets could lead to code execution in the SQL Server service context. Microsoft states that patch protected SQL Server 2000 and MSDE 2000 against the SQL Slammer worm. The comparison has clear limits. That issue required only delivery of a network packet, whereas CVE-2026-116941 requires authenticated access. Slammer is useful history, but it is not evidence of wormable behavior here.

Microsoft's current servicing model pairs Cumulative Updates (fixes, improvements and feature enhancements) with GDRs (broad impact and security issues). Microsoft's policy states CU31 is the last CU for SQL Server 2017, with later servicing limited to on-demand fixes and security updates. Ongoing servicing is visible in releases such as the September 8, 2026 SQL Server 2025 CU8 security update (KB5122769), which is background context and not a fix for this CVE.

References

• NVD: CVE-2026-116941
• CVE Record: CVE-2026-116941
• Microsoft Security Update Guide: CVE-2026-116941
• KB5129299: SQL Server 2025 CU10+GDR security update
• KB5129300: SQL Server 2022 CU27+GDR security update
• KB5129300 support article, November 10, 2026
• KB5132749: SQL Server 2017 RTM+GDR security update
• BleepingComputer: Microsoft November 2026 Patch Tuesday roundup
• Microsoft Learn: Servicing models for SQL Server
• KB5122769: SQL Server 2025 CU8 security update, September 8, 2026
• Microsoft Security Bulletin for SQL Server 2000 Resolution Service (2002)
• MITRE CWE 122: Heap Based Buffer Overflow
• FIRST CVSS v3.1 Specification Document
• CISA Known Exploited Vulnerabilities Catalog
• Zero Day Initiative: The November 2026 Security Update Review
• Senserva entry for CVE-2026-116941
• isMalicious entry for CVE-2026-116941
• VulDB entry for CVE-2026-116941
• DB Engines Ranking