Overview of CVE-2026-116946: Heap Buffer Overflow in Microsoft SQL Server Integration Packages Enables Authenticated Code Execution

Introduction

Microsoft's November 2026 SQL Server security release closes a heap buffer overflow that lets an authenticated attacker run code by handing a crafted file to an integration package that processes it automatically, with no further user interaction. The fix spans eight servicing branches across SQL Server 2017, 2019, 2022 and 2025, and some packages ship with documented behavior changes. For most teams, the practical work is selecting the correct build and planning the rollout rather than responding to a known campaign.

Technical information

Root cause

Microsoft describes CVE-2026-116946 as a heap buffer overflow in SQL Server that allows an authorized attacker to execute code over a network. NVD maps it to CWE-122, which MITRE defines as writing past the end of a buffer allocated on the heap. As a weakness class, CWE-122 can produce crashes and, in more favorable conditions for an attacker, arbitrary code execution, for example by overwriting function pointers stored near the corrupted allocation. That describes the class. Microsoft has not published the memory layout or control flow involved in this specific bug.

Where the bug lives

The short CVE description is generic, but the MSRC exploitation FAQ is more specific: an authenticated attacker supplies a specially crafted file as input to an affected integration package, and processing that file can execute code in the integration service context. The patch notes point to SQL Server Integration Services (SSIS) as the patched area. The November packages include several SSIS memory safety fixes. KB5132751 (SQL Server 2019 GDR) lists:

• 5658158: a memory access violation in the SSIS Raw File source component. Raw File source parses files, which makes it a plausible match for a crafted-file heap overflow, but Microsoft has not confirmed the mapping.
• 5657963: an integer overflow in the SSIS HTTP connection manager that can cause memory access issues.
• 5657341: a heap over-read in the SSIS SQL task's handling of OLE DB output parameters.
• 5656966: XSLT scripting turned off by default in the SSIS XML Task.

KB5129299 (SQL Server 2025) carries matching SSIS entries, including Raw File source fixes 5624036 and 5624143. These are the kinds of defects CWE-122 describes: buffer sizes taken from attacker-controlled input, or miscomputed through integer overflow, followed by heap writes. The usual fix is to add bounds and length checks before data is copied. SQL Server is closed source, so there is no public commit or diff to confirm the exact change.

Attack flow

Based on the MSRC FAQ, the documented sequence is:

1. The attacker authenticates and holds permission to supply input to the affected integration package.
2. The attacker supplies a specially crafted file.
3. The package processes the file. If processing is automatic, no additional user interaction is required, and attacker code can execute in the integration service context.

This is not a disclosed unauthenticated attack against the database engine. The advisory also does not claim that exploitation yields SYSTEM, domain administrator, or SQL Server sysadmin rights. The execution boundary it states is the integration service context.

CVSS breakdown

Microsoft's base vector, displayed by NVD as the CNA score (NVD has not supplied its own assessment):

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H  (8.8 High)
Temporal: E:U/RL:O/RC:C  (7.7)

• Attack vector, Network: reachable over the network under the documented prerequisites.
• Attack complexity, Low: the scoring assumes no specialized conditions.
• Privileges required, Low: basic user privileges, plus, per the FAQ, permission to supply integration input.
• User interaction, None: automatic package processing needs no extra interaction.
• Scope, Unchanged, with High confidentiality, integrity and availability impact.

The temporal score of 7.7 reflects unproven exploit code maturity, an official fix, and confirmed report confidence. It does not replace the 8.8 base score.

Exploitation status

At original publication, MSRC recorded "Publicly disclosed: No," "Exploited: No," and "Exploitation Less Likely." A Senserva tracker record reports no exploitation observed as of 10 November 2026, shows the CVE as not listed in the CISA Known Exploited Vulnerabilities catalog, and marks EPSS as Not scored. The reviewed sources provide no exploit code, indicators, or threat actor attribution for this CVE. So exploitation is not reported, which is a weaker statement than proven absent.

What is not disclosed

Microsoft has not identified the vulnerable function, the exact integration package component or file format, the precise permission name, the payload structure, or which KB fix list entry corresponds to this CVE.

Patch information

Microsoft fixed CVE-2026-116946 in its November 10, 2026 Patch Tuesday release. MSRC lists the remediation level as Official Fix ("A complete vendor solution is available"). The fix ships only as compiled binaries in eight security updates, one per supported servicing branch.

Servicing tracks

• GDR (General Distribution Release) carries only security and other broadly applicable critical fixes.
• CU (Cumulative Update) carries all accumulated fixes for the release, and its security fix ships as a CU+GDR package.

Install the package that matches the branch you are already on. Installing the wrong one either fails the prerequisite check or moves the instance onto a different servicing track.

Package selection

Each package is cumulative within its track. For example, KB5132751 includes the previous SQL Server 2019 GDR (KB5128495), so October's update does not need to be installed first. If an installed build falls outside the advisory's table, Microsoft says to review package prerequisites and release support status. Absence from the table alone does not mean a release is unsupported.

Verifying the fix

The fix is version gated. Query the engine version and compare it with the fixed build for your branch. A build equal to or higher than the fixed build is patched:

SELECT SERVERPROPERTY('ProductVersion');

For instance, KB5132751 raises the engine to product version 15.0.2210.4 (file version 2019.150.2210.4), and KB5129299 raises SQL Server 2025 CU10 to 17.0.5045.3. Microsoft also documents version identification through SQL Server Management Studio and the instance error log. You can check installers against Microsoft's published SHA256 hashes:

SQLServer2019-KB5132751-x64.exe  3E726D71E2528CC2E5F14D0D5308472C458453E990ED79535FA2D8273CEE0AF5
SQLServer2025-KB5129299-x64.exe  64AC66C63E7037F8578B3C2CB76D093E4E11F5D65951EC5545BE92AF44BEA190

Behavior changes to plan for

XSLT scripting is off by default. SSIS XML Tasks that depend on embedded XSLT script will stop working after the update. Microsoft documents restoring the old behavior by setting EnableXsltScript to 1 under the following key. Doing so removes that hardening, so reserve it for packages that need it.

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\{version}\SSIS\XMLTask

Recovery-time access violation. KB5129299 (SQL Server 2025 CU10) documents that querying sys.dm_exec_requests while a database is recovering (during a restore, during startup recovery, or before an availability group replica comes online) can raise an access violation and produce a dump file. The briefing notes the same known issue for KB5129300 (SQL Server 2022 CU27). Microsoft is working on a fix and lists three interim responses: enable trace flag 4696, avoid querying that DMV against recovering databases, or uninstall the update. With the trace flag enabled, monitoring queries against sys.dm_exec_requests or sys.sysprocesses on secondary replicas may return error 976 or 978. These measures address the regression only. They are not workarounds for CVE-2026-116946, and Microsoft publishes no substitute configuration change for the CVE itself.

Distribution

Every package is available through Windows Update / Microsoft Update, the Microsoft Update Catalog (search by KB number), and the Microsoft Download Center. SQL Server on Linux is updated through the configured CU package repository, and KB5129299 and KB5132751 apply to Linux as well as Windows. These are bundled releases: KB5132751 also fixes about 30 other SQL Server CVEs, and the SQL Server 2025 CU10 package fixes about 35, so whichever package you install covers the whole November SQL Server batch.

Affected systems and versions

The CVE record on NVD (supplied by Microsoft) lists the following affected intervals. The upper bounds match the fixed builds exactly. A few lower bounds differ slightly from the MSRC package selection ranges above, so use the MSRC ranges when choosing a package.

• SQL Server 2017 GDR: 14.0.0 up to but not including 14.0.2150.2
• SQL Server 2017 CU31: 14.0.3006.16 up to but not including 14.0.3570.2
• SQL Server 2019 GDR: 15.0.0 up to but not including 15.0.2210.4
• SQL Server 2019 CU32: 15.0.4003.23 up to but not including 15.0.4510.2
• SQL Server 2022 GDR: 16.0.0 up to but not including 16.0.1220.3
• SQL Server 2022 CU27: 16.0.4003.1 up to but not including 16.0.4315.2
• SQL Server 2025 GDR: 17.0.1050.2 up to but not including 17.0.1155.3 (MSRC selection range starts at 17.0.1000.7)
• SQL Server 2025 CU10: 17.0.4006.0 up to but not including 17.0.5045.3 (MSRC selection range starts at 17.0.4006.2)

The relevant configuration, per the FAQ, is an instance where an affected integration package processes files that an authenticated user is permitted to supply. Microsoft's update packages cover both Windows and Linux, so this should not be treated as a Windows-only issue.

Vendor security history

SQL Server has prior code execution vulnerabilities. CVE-2024-38087, published 9 July 2024, affects the SQL Server Native Client OLE DB Provider and is classified as CWE-415 (Double Free). It also scores 8.8, but its vector specifies no privileges required and user interaction required, the inverse of CVE-2026-116946's prerequisites. Equal scores do not imply equal attack pathways.

At the organizational level, the Cyber Safety Review Board's review of the 2023 Exchange Online intrusion (attributed to Storm-0558) found the incident preventable and described Microsoft's security culture as inadequate. Microsoft publicly accepted responsibility, committed to acting on all 16 applicable recommendations, and organized its Secure Future Initiative around Secure by Design, Secure by Default and Secure Operations. Its July 2026 SFI update reports migrating 100 percent of Microsoft Entra ID token signing keys in Azure public and US Government clouds to Azure Confidential Computing. Those findings and reforms concern Exchange Online and companywide controls, not this SQL Server bug. For context on exposure, DB Engines ranks SQL Server third in its November 2026 popularity ranking (score 693.53), which reflects popularity rather than installed base or market share.

References

• NVD: CVE-2026-116946
• CVE Record: CVE-2026-116946
• Microsoft Security Update Guide: CVE-2026-116946
• KB5132751: SQL Server 2019 GDR security update
• KB5129299: SQL Server 2025 CU10 security update
• KB5129299 servicing article
• KB5129300: SQL Server 2022 CU27 security update
• KB5132745: SQL Server 2019 CU32 security update
• KB5132749: SQL Server 2017 GDR security update
• ZDI: The November 2026 Security Update Review (thezdi.com)
• ZDI: The November 2026 Security Update Review (zerodayinitiative.com)
• MITRE CWE-122: Heap Based Buffer Overflow
• Microsoft Learn: Find the version and edition of your SQL Server Database Engine
• Senserva: CVE-2026-116946
• CVE Record: CVE-2024-38087
• DB Engines Ranking
• Microsoft Evaluation Center: SQL Server 2025
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft On the Issues: Microsoft's work to strengthen cybersecurity protection
• Microsoft Learn: Secure Future Initiative overview
• Microsoft Learn: What's new in the Secure Future Initiative