Brief Summary: Microsoft SQL Server CVE-2026-116943 Unauthenticated Buffer Overread Information Disclosure

Introduction

According to Microsoft's November 2026 advisory, an attacker with network access to a Microsoft SQL Server instance, and no credentials at all, may be able to read heap memory that belongs to the privileged SQL Server process. The flaw spans SQL Server 2017, 2019, 2022 and 2025 across eight servicing branches, so it reaches a large share of enterprise database estates, even though its rated impact is limited to confidentiality.

Microsoft rates CVE-2026-116943 Important, with a CVSS 3.1 base score of 7.5 (High). There is no documented code execution, integrity or availability impact, and Microsoft reported no exploitation at publication. This post covers what is known about the bug, which package fixes which build, and one patch compatibility issue that deserves attention before rollout.

Technical information

Root cause: a read past the end of a buffer

Microsoft describes the issue as a buffer overread in SQL Server that allows an unauthorized attacker to disclose information over a network. The assigned weakness is CWE-126. MITRE defines this as reading from a buffer through indexes or pointers that reference memory after the intended buffer. The flaw reads past a boundary, and no write past one is documented. Nothing is corrupted. Instead, bytes that were never meant to leave the process are returned to the caller.

This bug class typically appears when code trusts a length or offset it should have validated, then copies data starting at that offset or for that length without checking it against the real allocation size. The standard fix is to bounds-check the length or offset against the actual buffer size before copying any bytes back. SQL Server is closed source, so there is no public commit, diff or vulnerable code snippet to examine. The description above refers to the weakness class. It is not a confirmed reconstruction of Microsoft's implementation error.

What can leak

Microsoft's FAQ goes further than the short CVE description and says a successful attacker could view heap memory from a privileged process running on the server. Heap memory in a database engine can hold query text, cached row data or credentials. However, Microsoft does not say what the leaked memory contains, so the public evidence does not establish that any specific credential, key or record is exposed. In practice, the exposure is not bounded by what an ordinary database login would be permitted to query.

CVSS vector breakdown

Microsoft's CNA vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N:

• Attack vector, Network (AV:N): exploitable remotely over the network.
• Attack complexity, Low (AC:L): no special conditions are scored.
• Privileges required, None (PR:N): no authenticated account is needed.
• User interaction, None (UI:N): no victim action is required.
• Scope, Unchanged (S:U): impact stays within the same security authority.
• Confidentiality, High (C:H): information disclosure is the scored consequence.
• Integrity and Availability, None (I:N, A:N): neither is assigned.

NVD had not supplied its own assessment in the retrieved record. The 7.5 score is Microsoft's.

Which code path is it? Our inference

Microsoft lists CVE-2026-116943 in the November KB articles alongside more than 30 other SQL Server CVEs and does not say which bug reference entry corresponds to which CVE. Several fix list entries are overread or memory disclosure hardening, including an out-of-bounds read in log block record parsing and corrupted row-compressed records that "can return unintended memory content."

The entry that best fits this CVE's profile (network reachable, no authentication) is the SQL Connectivity fix, which "fixes an out of bounds memory read action that can occur during processing of certain client connection requests." It is bug 5270202 in the SQL Server 2022 CU27 package and 5270206 in the SQL Server 2017 CU31 package, and it applies to both Windows and Linux. This mapping is our inference, and Microsoft has not confirmed it. It does not change remediation: each package installs every fix it contains, and individual fixes cannot be applied on their own.

Attack flow

Based on the advisory and scoring, the documented scenario looks like this. Microsoft has not published the triggering message, endpoint or parser, so step 2 is intentionally general.

1. The attacker obtains network reachability to a SQL Server instance running an affected build. No login, privileges or user interaction are required.
2. The attacker sends input that causes the engine to read beyond the end of a valid buffer. If our inference above is correct, this occurs while the server processes certain client connection requests.
3. The server returns data that includes bytes from adjacent heap memory owned by the privileged SQL Server process.
4. The attacker collects the returned memory. Its contents are not specified by Microsoft and may vary.

No reproducible exploitation sequence or payload appears in the primary disclosures, and nothing published establishes code execution, authentication bypass into a SQL session, or a multi-stage exploit chain.

Exploitation status

At original publication, Microsoft's assessment was Publicly disclosed: No, Exploited: No and Exploitation Less Likely, with temporal metrics of Unproven exploit code maturity, Official Fix and Confirmed report confidence. OffSeq reports no indexed exploit code in Metasploit or Exploit DB, no public nuclei template, no observed traffic in its Mirage sensors, and that the CVE is not in CISA KEV. The SSVC data carried in the NVD record lists exploitation as none, automatable as yes and technical impact as partial. Microsoft credits Microsoft Red Team with the finding. No threat actor or campaign is associated with it. Low scored complexity and a "less likely" exploitation assessment measure different things, so they do not contradict each other.

Patch information

Microsoft shipped the fix on November 10, 2026 (Patch Tuesday). The MSRC advisory lists Remediation Level as Official Fix and instructs customers to install "the applicable November 2026 security update" for their SQL Server version. The fix ships as eight binary packages, one per supported servicing branch.

Choose the package for your branch

SQL Server has two servicing tracks. GDR packages contain security fixes only. CU+GDR packages contain security fixes on top of the latest cumulative update. Install the package that matches the build you run now. Installing the wrong one moves the instance onto a different servicing track. From the MSRC table:

To check whether an instance is patched, compare its version against the fixed build column:

SELECT SERVERPROPERTY('ProductVersion');

Every package is cumulative and includes the previous GDR for its branch. For example, KB5129300 supersedes KB5126934, the October 2026 CU27 GDR.

Distribution channels

Each KB is available through Windows Update / Microsoft Update, the Microsoft Update Catalog and the Microsoft Download Center. The KB pages publish SHA256 hashes so installers can be verified before deployment. SQL Server 2022 on Linux receives the update from the configured CU package repository, following the platform-specific instructions in the release notes. The retrieved guidance does not state whether a restart is required, so plan maintenance windows accordingly.

Known issue in KB5129300 (SQL Server 2022 CU27)

After installing KB5129300, queries against sys.dm_exec_requests that run while a database is still recovering (during RESTORE, startup recovery, or before an availability group replica comes online) can raise an access violation and write a dump file. Microsoft attributes this to a code change in the update that references internal in-memory structures before they are fully initialized. A fix is under investigation.

Microsoft's listed workarounds are:

• Enable trace flag 4696, which opts out of the change that causes the crash.
• Avoid querying the DMV during database recovery.
• Uninstall the update.

Trace flag 4696 only reverts the change behind the crash, and the security fix stays installed. That makes it a better option than uninstalling, which would also remove the fix for CVE-2026-116943. None of these workarounds address the CVE itself, and Microsoft offers no separate workaround for the vulnerability. The SQL Server 2017 CU31 package (KB5132746) does not list this known issue.

Affected systems and versions

Microsoft SQL Server 2017, 2019, 2022 and 2025 are affected, on both Windows and Linux where applicable. The NVD affected ranges, sourced from Microsoft's CNA data, use the fixed builds as exclusive upper bounds (lower bounds inclusive):

• SQL Server 2017 GDR: 14.0.0 up to, but not including, 14.0.2150.2
• SQL Server 2017 CU31: 14.0.3006.16 up to, but not including, 14.0.3570.2
• SQL Server 2019 GDR: 15.0.0 up to, but not including, 15.0.2210.4
• SQL Server 2019 CU32: 15.0.4003.23 up to, but not including, 15.0.4510.2
• SQL Server 2022 GDR: 16.0.0 up to, but not including, 16.0.1220.3
• SQL Server 2022 CU27: 16.0.4003.1 up to, but not including, 16.0.4315.2
• SQL Server 2025 GDR: 17.0.1050.2 up to, but not including, 17.0.1155.3
• SQL Server 2025 CU10: 17.0.4006.0 up to, but not including, 17.0.5045.3

The NVD lower bounds differ slightly from the "apply if current version is" ranges in the MSRC package table for some branches. Use the MSRC table to select a package, and the fixed build to confirm remediation. If an installed version does not appear in either list, Microsoft directs customers to review update prerequisites and the release's support status. Absence from the table alone does not establish that a version is unsupported.

Vendor security history

Microsoft says its Secure Future Initiative, launched in November 2023, embeds security across culture, governance and engineering, with principles including secure by design and protections enabled by default. The July 2026 progress report describes expanded vulnerability transparency, including CVE records enriched with CWE and CPE annotations and support for CSAF and VEX formats. These are companywide commitments. They do not measure effectiveness for SQL Server specifically.

For an independent view, the Cyber Safety Review Board concluded that the 2023 Exchange Online intrusion was preventable, attributing it to a cascade of avoidable errors and finding that Microsoft's security culture was inadequate and required an overhaul. That review concerns Exchange Online and is not evidence that this SQL Server CVE is related or exploited. In this case, the observable vendor response is a confirmed, internally discovered (Microsoft Red Team) bug with official fixes for every supported branch on the day of disclosure.

References

• NVD entry for CVE-2026-116943
• CVE.org record for CVE-2026-116943
• Microsoft Security Update Guide advisory
• KB5129300: Security update for SQL Server 2022 CU27
• KB5132746: Security update for SQL Server 2017 CU31
• KB5132749: Security update for SQL Server 2017 GDR
• KB5132748: Security update for SQL Server 2025 GDR
• NVD API record
• MITRE CWE-126: Buffer Overread
• OffSeq Threat Radar entry
• Senserva CVE summary
• CISA Known Exploited Vulnerabilities Catalog
• Microsoft SQL Server product page
• Microsoft Secure Future Initiative
• Microsoft July 2026 SFI Progress Report
• DB Engines Ranking
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Simple Talk: Top Database Platforms in 2026