Introduction
Microsoft's November 10, 2026 SQL Server updates close a heap-based buffer overflow that can let an unauthenticated attacker run code in the integration service context, with no SQL Server credentials and no user interaction required when the affected package runs automatically. The attack relationship is what makes CVE-2026-116945 worth a careful read. The vulnerable code processes a response coming back from a network endpoint that an integration package connects to, so exposure depends on where your packages reach out, not simply on whether a SQL Server listener is reachable.
Microsoft scores the issue 9.8 under CVSS 3.1, yet labels its severity Important and assesses exploitation as Less Likely. At publication it was neither publicly disclosed nor exploited. Below we summarize what the advisory and the November KB articles establish, where the public record stops, and how to choose the right package for each servicing branch.
Technical information
Root cause class: CWE-122 in a response-parsing path
Microsoft classifies the bug as CWE-122, Heap based Buffer Overflow. MITRE defines this class as a buffer overflow where the overwritten buffer was allocated in the heap. That definition describes the weakness class only. The advisory does not name the function, allocation or data structure involved in this CVE.
The MSRC FAQ supplies the most useful technical fact. An attacker who controls a network endpoint used by an affected integration package can return a specially crafted response when the package connects, and processing that response could allow attacker code to execute in the integration service context. That places the overflow in client-side code that parses data returned from a remote server. The advisory does not establish that exploitation occurs through a SQL login attempt or an arbitrary query sent to the database engine's TDS listener.
Attack flow
Based solely on the scenario Microsoft describes:
- The attacker controls a network endpoint that an affected integration package uses.
- The package executes and connects to that endpoint. When the package runs automatically, no SQL Server credentials and no additional user interaction are required.
- The endpoint returns a specially crafted response.
- The package processes the response, triggering the heap-based overflow.
- Attacker code may execute in the integration service context.
This is a disclosed exploitation scenario, not a documented intrusion. Microsoft does not identify the network protocol, the specific integration package, the vulnerable function, the malformed response structure, allocation sizes or exploitation primitives, and it publishes no payload or reproducible procedure.
Narrowing down the vulnerable component (our inference)
SQL Server is closed source, so there is no public commit or diff to study. Microsoft also does not link the internal bug IDs in its KB fix tables to specific CVEs, and the November release fixes many SQL Server bugs at once: ZDI counts 59 SQL Server-related CVEs, 24 of them heap buffer overflows. No source we reviewed says which code change fixes CVE-2026-116945.
The advisory's integration package and integration service language points to SQL Server Integration Services (SSIS). Three SSIS fixes appear in every branch we checked (2017 GDR, 2022 GDR, 2022 CU27 and 2025 CU10):
- An integer overflow in the SSIS HTTP connection manager that "can cause memory access issues" (bug 5657882 in KB5129300, 5657881 in KB5132747, 5658051 in KB5132749 and 5624079 in KB5129299)
- A heap over-read in the SSIS SQL task when it handles OLE DB output parameters
- A memory access violation in the Raw File source component
Of these, the HTTP connection manager fix fits the advisory best. That component fetches content from a remote endpoint, and an integer overflow in a length calculation is a classic route to a heap overflow: a size computed from attacker-controlled response data wraps around, the program allocates a buffer that is too small, and then copies the full response into it. The likely fix is checked arithmetic or bounds validation before the allocation and copy. This mapping is our inference. Microsoft has not confirmed it.
Reading the CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
The base metrics (network vector, low complexity, no privileges, no user interaction, unchanged scope, high confidentiality, integrity and availability impact) produce the 9.8 base score. The temporal metrics include E:U, meaning exploit code maturity is Unproven (no publicly available exploit code, or an exploit that remains theoretical), and RL:O, an Official Fix, which brings the temporal score to 8.5. These are potential impact assessments, not observations of an attack. The AV:N designation should be read together with the FAQ: the network condition is an integration package connecting to an attacker-controlled endpoint, not an unsolicited packet reaching any SQL Server instance.
Exploitation status
At publication MSRC recorded "Publicly disclosed: No", "Exploited: No" and "Exploitation Less Likely". Event Monitor reports no exploitation, StackFlag describes the issue as not known to be exploited, and Senserva states that exploitation was not confirmed as of November 10, 2026. The reviewed sources identify no threat actor, campaign, malware family, victim, public exploit or CVE-specific indicators of compromise. StackFlag's characterizations of automatic exploitability and full control are explicitly labeled as estimates.
Patch information
Microsoft fixed CVE-2026-116945 in its November 10, 2026 Patch Tuesday release for SQL Server. The evidence for the fix is Microsoft's own material: the MSRC advisory, the per-branch KB articles and the fixed build numbers. Every November KB we checked lists CVE-2026-116945 among the vulnerabilities it resolves: KB5129300, KB5132747, KB5132749 and KB5129299.
Pick the package for your servicing branch
SQL Server is patched along two parallel tracks. GDR (General Distribution Release) builds carry only security and critical fixes on top of RTM. CU+GDR builds layer the same security fixes onto the latest Cumulative Update. Install the package that matches the branch you are on:
- KB5129299, SQL Server 2025 CU10+GDR: fixed build 17.0.5045.3, applies to 17.0.4006.2 through 17.0.5035.5
- KB5132748, SQL Server 2025 RTM+GDR: fixed build 17.0.1155.3, applies to 17.0.1000.7 through 17.0.1145.4
- KB5129300, SQL Server 2022 CU27+GDR: fixed build 16.0.4315.2, applies to 16.0.4003.1 through 16.0.4305.5
- KB5132747, SQL Server 2022 RTM+GDR: fixed build 16.0.1220.3, applies to 16.0.1000.6 through 16.0.1210.3
- KB5132745, SQL Server 2019 CU32+GDR: fixed build 15.0.4510.2, applies to 15.0.4003.23 through 15.0.4500.2
- KB5132751, SQL Server 2019 RTM+GDR: fixed build 15.0.2210.4, applies to 15.0.2000.5 through 15.0.2200.2
- KB5132746, SQL Server 2017 CU31+GDR: fixed build 14.0.3570.2, applies to 14.0.3006.16 through 14.0.3560.2
- KB5132749, SQL Server 2017 RTM+GDR: fixed build 14.0.2150.2, applies to 14.0.1000.169 through 14.0.2140.2
To confirm a host is patched, check that the reported version is at least the fixed build for its branch:
SELECT @@VERSION; SELECT SERVERPROPERTY('ProductVersion');
Delivery and integrity
Each package is cumulative within its track. KB5129300, for instance, also includes everything through the October CU27 GDR (KB5126934). Packages are available through Windows Update and Microsoft Update, the Microsoft Update Catalog and the Microsoft Download Center. On Linux, SQL Server 2022 is updated through the configured CU repository, and the KB5129299 article documents a Linux route through the Cumulative Update repository for SQL Server 2025.
Published SHA256 values for the SQL Server 2022 x64 installers:
KB5129300 (2022 CU27+GDR): 07C854F949CEBA92B43BC08A726AC819545C9CBD11C2B765FF578485FE219F52 KB5132747 (2022 GDR): B566F09A461AE4A563A11FF65FD6385993088437A0F3243AA114A90AF5B71A79
The Download Center page for KB5129299 notes that a restart may be required after installation. That statement applies to that package and should not be generalized to every KB above.
Behavior changes and known issues shipped in the same packages
XSLT scripting is now off by default in the SSIS XML Task (for example, bug 5656899 in KB5129300). Microsoft does not tie this change to this CVE, but it changes SSIS behavior. Microsoft documents restoring the previous behavior by setting EnableXsltScript to 1 under the following key. Test packages that depend on XSLT script blocks after updating.
HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\{version}\SSIS\XMLTask
Recovery query access violation. KB5129300 and KB5129299 both document a known issue: querying sys.dm_exec_requests while a database is still recovering (for example during RESTORE, startup recovery, or on an availability group replica that has not finished coming online) can raise an access violation and generate a dump, because internal structures are read before they are fully initialized. Microsoft documents two ways around it: trace flag 4696, which opts out of that code change, or avoiding those queries against recovering databases. This addresses an operational side effect of the update, not the vulnerability itself.
What the update is not
The advisory publishes no configuration workaround and does not instruct administrators to disable integration packages. Microsoft's general SQL Server guidance (firewall and port restrictions, minimum necessary permissions, enabling only required features) remains useful as a supporting control, but none of it repairs the heap overflow or removes the disclosed endpoint scenario.
Affected systems and versions
NVD's affected product data, sourced from Microsoft, uses the fixed builds above as exclusive upper bounds. For example, SQL Server 2022 (GDR) is affected from 16.0.0 up to but not including 16.0.1220.3. Microsoft's update selection table maps installed versions as follows:
- SQL Server 2025 CU10+GDR branch: 17.0.4006.2 through 17.0.5035.5
- SQL Server 2025 RTM+GDR branch: 17.0.1000.7 through 17.0.1145.4
- SQL Server 2022 CU27+GDR branch: 16.0.4003.1 through 16.0.4305.5
- SQL Server 2022 RTM+GDR branch: 16.0.1000.6 through 16.0.1210.3
- SQL Server 2019 CU32+GDR branch: 15.0.4003.23 through 15.0.4500.2
- SQL Server 2019 RTM+GDR branch: 15.0.2000.5 through 15.0.2200.2
- SQL Server 2017 CU31+GDR branch: 14.0.3006.16 through 14.0.3560.2
- SQL Server 2017 RTM+GDR branch: 14.0.1000.169 through 14.0.2140.2
These are update selection ranges, not a replacement for the CNA's affected version declarations. If an installed version does not appear in the table, Microsoft directs administrators to review update prerequisites and release support status. Absence alone does not establish that a version is unsupported. The disclosed scenario involves an affected integration package connecting to a network endpoint that an attacker controls, so instances running integration packages that reach out to external or untrusted endpoints match the documented attack relationship most directly.
Vendor security history
Microsoft SQL Server ranks third in the November 2026 DB Engines popularity ranking with a score of 693.53, the same position it held in the October 2026 and November 2025 columns. DB Engines describes this as a popularity ranking, not revenue or installed base share, so it does not quantify vulnerable installations.
The most cited historical precedent is Microsoft Security Bulletin MS02-039, published July 24, 2002, which addressed three SQL Server 2000 Resolution Service vulnerabilities including buffer overruns. Microsoft later stated that the patch protects SQL Server 2000 and MSDE 2000 against the SQL Slammer worm, and CERT independently documented the remotely exploitable Resolution Service flaw (VU#484891). That case involved a crafted packet executing code in the SQL Server service context. It is not evidence that CVE-2026-116945 is exploited, uses the same protocol or could behave like Slammer.
Microsoft describes its Security Development Lifecycle as incorporating security throughout planning, launch, monitoring and updating, and its July 2026 Secure Future Initiative report describes embedding Zero Trust controls into platforms, engineering pipelines and governance. The same report acknowledges that security is continuous rather than a completed milestone, which this advisory illustrates: vendor programs do not remove the need to track and apply branch-specific updates.
References
- NVD entry for CVE-2026-116945
- CVE.org record for CVE-2026-116945
- MSRC Security Update Guide: CVE-2026-116945
- KB5129300: SQL Server 2022 CU27 security update
- KB5132747: SQL Server 2022 GDR security update
- KB5132749: SQL Server 2017 GDR security update, November 2026
- KB5129299: SQL Server 2025 CU10 security update, November 10, 2026
- Microsoft Download Center: KB5129299
- Zero Day Initiative: The November 2026 Security Update Review
- MITRE CWE-122: Heap based Buffer Overflow
- Microsoft Learn: SQL Server security best practices
- Microsoft Learn: SQL Database Engine
- Event Monitor: Critical Vulnerability CVE-2026-116945
- StackFlag: CVE-2026-116945
- Senserva: CVE-2026-116945
- DB Engines popularity ranking
- Microsoft Security Bulletin MS02-039
- CERT VU#484891: SQL Server 2000 Resolution Service
- Microsoft Secure Future Initiative progress report, July 2026
- Microsoft SQL Server Blog: SQL platform and data security
