Brief Summary: Microsoft SQL Server CVE-2026-116942 Heap Buffer Overflow Allowing Authenticated Remote Code Execution

Introduction

Microsoft's November 10, 2026 SQL Server security updates close a heap buffer overflow that lets an authenticated, low-privileged database user send a crafted network request and potentially run code inside the SQL Server service context. The fix ships as eight separate builds across four product versions and two servicing tracks. For most teams, the hard part is less about finding a patch than making sure the correct package lands on each instance.

Technical information

Root cause

Microsoft maps CVE-2026-116942 to CWE-122, heap-based buffer overflow. MITRE describes this weakness as a buffer overflow in which the overwritten buffer lives in heap memory, generally allocated through a routine such as malloc(). That tells us the class of bug, but not where it sits inside the engine.

SQL Server is closed source, so there is no public commit, diff, or code snippet for this fix. The MSRC advisory does not disclose the request format, the vulnerable routine, the memory layout, or a reproducible exploitation procedure. Microsoft also does not publish a mapping between internal bug IDs and CVEs, and each November KB bundles roughly 30 SQL Server CVEs.

In our review of the SQL Server 2022 CU27 KB, several fix entries fit a heap overflow root cause:

• bug 5622178, "heap buffer overflow during XML operation"
• bug 5723292, a heap buffer overflow in the Log Reader Agent
• bug 5632848, a buffer overflow in merge replication WebSync XML handling

None of these is officially tied to CVE-2026-116942. We read them as general hardening themes in this release (bounds checks, input validation, memory safety), not as a confirmed root cause.

Attack flow as disclosed

Microsoft's advisory describes the following sequence:

1. The attacker holds authenticated, low-privilege access to an affected SQL Server instance.
2. The attacker sends a specially crafted request to the server over the network.
3. The request triggers the heap buffer overflow in the SQL Server engine.
4. Successful exploitation could result in code execution in the SQL Server service context. No interaction from another user is required.

The documented outcome is execution in the SQL Server service context. An escape to the host or full administrator takeover is not established for this CVE. This is also a memory corruption flaw, not a SQL injection issue.

Scoring

Microsoft assigns a CVSS 3.1 base score of 8.8, a temporal score of 7.7, and a maximum severity rating of Important. The base vector is:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The extended vector adds E:U/RL:O/RC:C:

E:U/RL:O/RC:C

In plain terms:

• Attack vector, Network: delivered over the network
• Attack complexity, Low: no specialized attack conditions are assumed
• Privileges required, Low: basic authorized access to SQL Server is needed
• User interaction, None: no other user has to do anything
• Scope, Unchanged: impact stays within the same security authority
• Confidentiality, Integrity, Availability: High
• Exploit maturity, remediation level, report confidence: Unproven, Official Fix, Confirmed

The base and temporal scores describe severity and maturity. Neither is a probability of exploitation.

Exploitation status

At original publication Microsoft reported "Publicly disclosed: No," "Exploited: No," and "Exploitation Less Likely," with exploit code maturity Unproven. Secondary sources Senserva and VulDB report no CISA KEV inclusion. Senserva noted that EPSS had not scored the CVE in its November 10 snapshot, while VulDB shows 0.00000. Neither should be read as a measured zero probability.

Microsoft credits Pwnforr777 through coordinated vulnerability disclosure. That is a research credit, not attribution. We found no named threat actors, campaigns, malware families, or indicators of compromise associated with this CVE in the reviewed material.

Patch information

Microsoft fixed CVE-2026-116942 in its November 10, 2026 SQL Server security updates, and MSRC lists the remediation level as Official Fix. Because the product is closed source, the patch is visible only as new binary builds described in the KB articles.

One update per servicing branch

SQL Server has two servicing tracks, and Microsoft released a separate fixed build for each:

• GDR (General Distribution Release): security and critical fixes only, applied on top of RTM.
• CU+GDR: the same security fixes, built on top of the latest Cumulative Update.

You need the package matching the branch you already run. Installing a CU+GDR package on a GDR-only server moves that server onto the CU track.

• KB5129299, SQL Server 2025 CU10+GDR: fixed build 17.0.5045.3. Apply if the current version is 17.0.4006.2 through 17.0.5035.5.
• KB5132748, SQL Server 2025 RTM+GDR: fixed build 17.0.1155.3. Apply if the current version is 17.0.1000.7 through 17.0.1145.4.
• KB5129300, SQL Server 2022 CU27+GDR: fixed build 16.0.4315.2. Apply if the current version is 16.0.4003.1 through 16.0.4305.5.
• KB5132747, SQL Server 2022 RTM+GDR: fixed build 16.0.1220.3. Apply if the current version is 16.0.1000.6 through 16.0.1210.3.
• KB5132745, SQL Server 2019 CU32+GDR: fixed build 15.0.4510.2. Apply if the current version is 15.0.4003.23 through 15.0.4500.2.
• KB5132751, SQL Server 2019 RTM+GDR: fixed build 15.0.2210.4. Apply if the current version is 15.0.2000.5 through 15.0.2200.2.
• KB5132746, SQL Server 2017 CU31+GDR: fixed build 14.0.3570.2. Apply if the current version is 14.0.3006.16 through 14.0.3560.2.
• KB5132749, SQL Server 2017 RTM+GDR: fixed build 14.0.2150.2. Apply if the current version is 14.0.1000.169 through 14.0.2140.2 (see the note in the affected systems section).

Verifying the fix

Compare the engine version with the fixed build for your branch. If it is the same or higher, the fix is in place.

SELECT SERVERPROPERTY('ProductVersion');

For example, KB5129300 (SQL Server 2022 CU27) raises the engine to product version 16.0.4315.2, file version 2022.160.4315.2. KB5132751 (2019 GDR) raises it to 15.0.2210.4, file version 2019.150.2210.4. The KB pages list CVE-2026-116942 among the vulnerabilities each update resolves. We checked the 2022 CU27 and 2019 GDR pages directly, and the 2022 CU27 package applies to both Windows and Linux, all editions.

A correction on KB5126934

One upstream source claimed the October 2026 CU27 GDR (KB5126934) fixes this CVE. Microsoft's data does not support that. MSRC lists KB5126934 only as the previous servicing release that KB5129300 "also includes." KB5126934 is the starting point being patched, not the fix. Builds up to 16.0.4305.5 remain in the vulnerable range, and the first fixed build on the 2022 CU27 track is 16.0.4315.2.

Obtaining the update

Each package is available through Windows Update and Microsoft Update, the Microsoft Update Catalog, and the Microsoft Download Center. Linux installs update through the configured SQL Server CU repository. The Download Center notes that a restart may be required after installation. Microsoft publishes SHA256 hashes for download verification, for example:

SQLServer2022-KB5129300-x64.exe  07C854F949CEBA92B43BC08A726AC819545C9CBD11C2B765FF578485FE219F52
SQLServer2019-KB5132751-x64.exe  3E726D71E2528CC2E5F14D0D5308472C458453E990ED79535FA2D8273CEE0AF5

The advisory does not list a vulnerability-specific workaround. The documented corrective action is the applicable security update.

Known regression in KB5129300

The SQL Server 2022 CU27 package has a documented known issue. Querying sys.dm_exec_requests while a database is still recovering can cause an access violation that terminates SQL Server and writes a dump file. This can occur during RESTORE, startup recovery, or while an availability group replica is coming online. Microsoft attributes it to a change in this update that uses internal in-memory structures before they are fully set up. Interim options:

• Enable trace flag 4696 to opt out of that specific change while keeping the security fix.
• Avoid running that DMV against recovering databases.
• Uninstall the update, which also removes the security fix.

These are responses to the update's regression, not alternative mitigations for CVE-2026-116942.

Affected systems and versions

Per Microsoft's advisory version range table, the following builds are vulnerable:

• SQL Server 2025 CU10+GDR branch: 17.0.4006.2 through 17.0.5035.5 (NVD's range starts at 17.0.4006.0, which makes no practical difference)
• SQL Server 2025 RTM+GDR branch: 17.0.1000.7 through 17.0.1145.4
• SQL Server 2022 CU27+GDR branch: 16.0.4003.1 through 16.0.4305.5 (Windows and Linux)
• SQL Server 2022 RTM+GDR branch: 16.0.1000.6 through 16.0.1210.3
• SQL Server 2019 CU32+GDR branch: 15.0.4003.23 through 15.0.4500.2
• SQL Server 2019 RTM+GDR branch: 15.0.2000.5 through 15.0.2200.2
• SQL Server 2017 CU31+GDR branch: 14.0.3006.16 through 14.0.3560.2
• SQL Server 2017 RTM+GDR branch: 14.0.1000.169 through 14.0.2140.2 (listed in the MSRC FAQ table only)

Catalog coverage differs between sources. MSRC's FAQ table lists eight servicing rows, including 2017 RTM+GDR with KB5132749. The advisory's affected products list and NVD's affected product data contain seven entries and name only 2017 CU31, not 2017 RTM+GDR. Starting version boundaries also differ slightly between the two. We recommend using the full MSRC servicing table for KB selection, and 2017 GDR users should still install KB5132749 to stay current.

Exploitation requires an authenticated, low-privilege SQL Server login and network reachability to the instance.

Vendor security history

SQL Server is a widely deployed RDBMS. DB-Engines ranks it third in its November 2026 popularity ranking with a score of 693.53, while noting that the ranking measures popularity, not market share.

The most relevant prior issue is CVE-2025-49717, released July 8, 2025. It was also a CWE-122 remote code execution vulnerability in SQL Server, rated Important with a CVSS base score of 8.5. Its prerequisites differed: an authenticated attacker had to execute a specially crafted query and take additional actions to prepare the target environment, giving it High attack complexity. For that older CVE, Microsoft explicitly described a possible escape from the SQL Server context to execution on the host, and reported no exploitation at publication. Those details belong to CVE-2025-49717 only. The current advisory specifies execution in the SQL Server service context.

The comparison shows a recurring class of memory safety defects and an established advisory and patching process. It does not show a shared root cause or a common exploit. Microsoft's Secure Future Initiative (July 2026 progress report) frames security as designed in, enabled by default, and continuously validated. That is a vendor-wide commitment rather than evidence about this specific flaw.

References

• Microsoft Security Update Guide: CVE-2026-116942
• NVD: CVE-2026-116942
• CVE Record: CVE-2026-116942
• NVD API record for CVE-2026-116942
• KB5129300: Security update for SQL Server 2022 CU27, November 10, 2026
• KB5132751: Security update for SQL Server 2019 GDR
• Microsoft Download Center: KB5129300
• Microsoft Learn: Latest updates and version history for SQL Server
• MITRE CWE-122: Heap based Buffer Overflow
• Microsoft Security Update Guide: CVE-2025-49717
• DB-Engines Ranking
• DB-Engines: Microsoft SQL Server system properties
• Microsoft Secure Future Initiative progress report, July 2026
• VulDB entry for CVE-2026-116942
• Senserva entry for CVE-2026-116942