Introduction
A heap overflow in Microsoft SQL Server's replication data path gives an attacker who controls a replication peer a route to code execution inside the affected replication process on a partner server, without needing an account on that server. For organizations that replicate data between SQL Server instances, CVE-2026-118106 turns an existing replication relationship into the attack surface. Microsoft shipped fixes for it across eight SQL Server servicing branches on November 10, 2026.
The CVSS 3.1 base score is 8.1 (High), Microsoft rates the issue Important, and the temporal score drops to 7.1 because an official fix exists and exploitation is unproven. The flaw is unauthenticated, but it is also tightly bound to replication configuration and peer control, and the gap between those numbers reflects that.
Technical information
Root cause
Microsoft classifies the weakness as CWE-122, a heap-based buffer overflow: a write past the end of a buffer allocated on the heap. MITRE notes that this weakness class can cause crashes or code execution, for example through corruption of function pointers. That is general CWE context, not a disclosed description of this specific SQL Server defect.
The MSRC FAQ is more specific about where the bug lives. An attacker who controls a replication peer can send specially crafted data over an existing replication connection, and processing that data could permit code execution in the affected replication process. Replication components already trust the peer they are connected to, which is why a missing bounds check on peer-supplied data becomes exploitable here.
Which code was likely changed
SQL Server is closed source, so there is no public commit or diff. Microsoft's KB articles list fixes by internal bug number and do not say which bug corresponds to which CVE. Several replication fixes in the November release fit the MSRC description:
- A heap buffer overflow in the Log Reader Agent (bug 5723268 in 2017 CU31, 5723272 in 2017 GDR, 5723292 in 2022 CU27, 5723117 in 2025 CU10)
- Replication queue parameter validation that now rejects boundary strings longer than the WCHAR conversion buffer (bugs 5723045 and 5723094 in 2017 CU31)
- Bounded validation when Merge Replication parses error sources (5723134), plus extra checks on column ordinals in replication rowsets (5649820)
- On SQL Server 2022 CU27 only, a buffer overflow when merge replication processes more than 250 WebSync XML nickname entries (5632848)
These fixes share one pattern. Before the update, the code copied or converted lengths, counts or strings supplied by the peer into fixed-size heap buffers without checking them. After the update, those values are checked against the buffer size, and oversized input is rejected instead of being written past the end of the allocation.
Mapping CVE-2026-118106 to any single bug ID above is our inference. Microsoft has not published that mapping, and each KB fixes many CVEs at once. KB5132746 alone lists 31 SQL Server CVEs, including this one.
Preconditions
- The target instance must already have the vulnerable replication feature and topology configured. Microsoft states that an attacker with access to a participating database or replication peer cannot enable that configuration through this vulnerability.
- The attacker must control a replication peer.
- Data is delivered over an existing replication connection.
- No account on the target server is required.
- No additional user interaction is required during normal replication.
Attack flow
Based on the MSRC FAQ, the attack proceeds as follows:
- A target SQL Server instance participates in a replication topology with the vulnerable replication feature configured.
- The attacker obtains control of a peer in that topology. The sources do not describe how that control is obtained.
- Using the existing replication connection, the controlled peer sends specially crafted replication data.
- The affected replication component on the target processes the data, and the unchecked value causes a write beyond a heap buffer.
- Successful exploitation results in code execution in the context of the affected replication process.
The advisory does not identify the vulnerable function, the precise data structure, the malformed payload layout, or a working exploit sequence. It also does not establish execution as an operating system administrator. The supported execution context is the affected replication process.
CVSS breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Temporal: E:U/RL:O/RC:C (Unproven, Official Fix, Confirmed)
Attack vector Network and Privileges None reflect that no target account is needed. Attack complexity High reflects the replication configuration and peer control prerequisites. Confidentiality, integrity and availability are all High within an unchanged scope. NVD displays Microsoft's 8.1 score and had not supplied its own assessment in the retrieved record.
In practice, these metrics support a high-consequence assessment. They do not mean every network-reachable SQL Server is exploitable. Exposure depends on replication topology and on who controls the peers.
Exploitation status
At publication, Microsoft recorded Exploited: No, Publicly disclosed: No, and Exploitation Less Likely. Senserva reports the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The reviewed sources contain no actor attribution, campaign, or public exploit code.
Patch information
Microsoft fixed CVE-2026-118106 in its November 10, 2026 SQL Server security updates. The MSRC advisory lists the Remediation Level as Official Fix.
Servicing tracks
SQL Server updates ship on two tracks, and you need the package for the track your server is on:
- GDR updates contain only security and critical fixes, for servers that stay on the RTM/GDR baseline.
- CU+GDR updates add the same security fixes on top of the latest Cumulative Update.
Fixed builds and selection ranges
The MSRC table maps each installed version range to the correct package:
- SQL Server 2025 CU10+GDR: KB5129299, fixed build 17.0.5045.3. Apply if the current version is 17.0.4006.2 through 17.0.5035.5.
- SQL Server 2025 RTM+GDR: KB5132748, fixed build 17.0.1155.3. Apply if the current version is 17.0.1000.7 through 17.0.1145.4.
- SQL Server 2022 CU27+GDR: KB5129300, fixed build 16.0.4315.2. Apply if the current version is 16.0.4003.1 through 16.0.4305.5.
- SQL Server 2022 RTM+GDR: KB5132747, fixed build 16.0.1220.3. Apply if the current version is 16.0.1000.6 through 16.0.1210.3.
- SQL Server 2019 CU32+GDR: KB5132745, fixed build 15.0.4510.2. Apply if the current version is 15.0.4003.23 through 15.0.4500.2.
- SQL Server 2019 RTM+GDR: KB5132751, fixed build 15.0.2210.4. Apply if the current version is 15.0.2000.5 through 15.0.2200.2.
- SQL Server 2017 CU31+GDR: KB5132746, fixed build 14.0.3570.2. Apply if the current version is 14.0.3006.16 through 14.0.3560.2.
- SQL Server 2017 RTM+GDR: KB5132749, fixed build 14.0.2150.2. Apply if the current version is 14.0.1000.169 through 14.0.2140.2.
Obtaining and verifying the update
Each KB is available from Windows Update, the Microsoft Update Catalog and the Microsoft Download Center. The KBs publish SHA256 hashes so the package can be checked before installation:
KB5132746 (SQL Server 2017 CU31+GDR, x64): 07DAFEBB513142EDCDA20A7BBE9B2195C1FCCA04CC51DFBB4BA26A3983DC0BB2 KB5132749 (SQL Server 2017 GDR, x64): D5583711DC58E747BD96C521635747D0C59D1255DE94B355A545A472DC541329
Updates are cumulative within a track. For example, the 2017 CU31+GDR package rolls up the earlier CU31 GDR, KB5128496, so only the latest package is needed. After installing, confirm the instance reports the fixed product version for its branch, such as 14.0.3570.2 (file version 2017.140.3570.2) for 2017 CU31.
Known regression in two CU packages
KB5129299 (2025 CU10) and KB5129300 (2022 CU27) document that querying sys.dm_exec_requests while a database is recovering might cause an access violation and generate a dump file. Documented contexts include a database RESTORE, startup recovery, and an availability group replica that has not finished coming online. For 2025 CU10, Microsoft attributes this to internal memory structures being referenced before initialization completes and says it is investigating a fix.
Microsoft lists three options: enable trace flag 4696 to opt out of the problematic code change, avoid those queries against recovering databases, or uninstall the update. These address the update regression only. Uninstalling the update removes the fix for CVE-2026-118106 and is not a remediation.
Other changes in the same release
The release includes behavior changes unrelated to this CVE. For example, XSLT scripting in the SSIS XML Task is now turned off by default, and it can be turned back on by setting the EnableXsltScript registry value to 1. The SQL Server 2025 GDR article also recommends enabling encryption with Extended Protection as general hardening, which is not a substitute for the CVE fix. Review the full fix table in your branch's KB before rollout. No CVE-specific interim workaround was published.
Affected systems and versions
Affected products are Microsoft SQL Server 2017, 2019, 2022 and 2025 at builds below the fixed thresholds in their respective servicing branches:
- SQL Server 2017 RTM/GDR: 14.0.1000.169 through 14.0.2140.2 (NVD lists 2017 GDR as affected from 14.0.0 up to, but not including, 14.0.2150.2)
- SQL Server 2017 CU31: 14.0.3006.16 through 14.0.3560.2 (fixed in 14.0.3570.2)
- SQL Server 2019 RTM/GDR: 15.0.2000.5 through 15.0.2200.2 (fixed in 15.0.2210.4)
- SQL Server 2019 CU32: 15.0.4003.23 through 15.0.4500.2 (fixed in 15.0.4510.2)
- SQL Server 2022 RTM/GDR: 16.0.1000.6 through 16.0.1210.3 (fixed in 16.0.1220.3)
- SQL Server 2022 CU27: 16.0.4003.1 through 16.0.4305.5 (fixed in 16.0.4315.2)
- SQL Server 2025 RTM/GDR: 17.0.1000.7 through 17.0.1145.4 (fixed in 17.0.1155.3)
- SQL Server 2025 CU10: 17.0.4006.2 through 17.0.5035.5 (fixed in 17.0.5045.3)
Vulnerable configuration: exploitation requires that the instance already has the vulnerable replication feature and topology configured, and that the attacker controls a replication peer connected to it. Instances in these version ranges without that replication configuration are still unpatched but do not meet the published attack preconditions.
Vendor security history
Microsoft SQL Server ranked third in the DB-Engines November 2026 popularity ranking, which measures popularity rather than installed share. On the organizational side, the Cyber Safety Review Board concluded that the 2023 Exchange Online intrusion attributed to Storm-0558 was preventable and that Microsoft's security culture was inadequate and required an overhaul.
In a June 13, 2024 response, Microsoft accepted responsibility, said it was acting on all 16 recommendations applicable to it, and described the Secure Future Initiative, grounded in Secure by Design, Secure by Default and Secure Operations. That incident concerns Exchange Online and has no technical or attribution connection to this SQL Server CVE. For CVE-2026-118106 specifically, Microsoft published configuration prerequisites, an exploitability assessment, and branch-specific packages, and disclosed regressions in the accompanying KB articles.
References
- NVD: CVE-2026-118106
- CVE Record: CVE-2026-118106
- Microsoft Security Update Guide: CVE-2026-118106
- KB5132746: SQL Server 2017 CU31 security update
- KB5132749: SQL Server 2017 GDR security update
- KB5129300: SQL Server 2022 CU27 security update
- KB5129299: SQL Server 2025 CU10 security update
- KB5132745: SQL Server 2019 CU32 security update
- KB5132751: SQL Server 2019 GDR security update
- KB5132747: SQL Server 2022 GDR security update
- KB5132748: SQL Server 2025 GDR security update
- Senserva: CVE-2026-118106
- VulDB: CVE-2026-118106
- MITRE CWE-122: Heap based Buffer Overflow
- Microsoft Learn: SQL Database Engine
- DB-Engines Ranking
- Microsoft On the Issues: Microsoft's work to strengthen cybersecurity protection
- CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
- CISA Known Exploited Vulnerabilities Catalog
