Overview of CVE-2026-66813: Out-of-Bounds Read Leading to Privilege Escalation in Microsoft SQL Server

Introduction

Microsoft's November 2026 SQL Server security updates fix an out-of-bounds read that, according to the vendor's advisory, can let an attacker elevate privileges to SQL sysadmin, and in one FAQ answer, to SYSTEM. Because the fix spans SQL Server 2017 through 2025 across eight separate servicing branches, the practical work for most database teams is mapping each instance to the correct package and planning around a documented known issue in two of those packages.

Microsoft rates the issue CVSS 3.1 8.1 (temporal 7.1) with an Important severity. At publication, Microsoft reported it as not exploited, not publicly disclosed, and Exploitation Less Likely.

Technical information

Root cause class

Microsoft describes the flaw in one line: "Out of bounds read in SQL Server allows an unauthorized attacker to elevate privileges over a network." It is classified as CWE-125: Out of bounds Read.

MITRE defines CWE-125 as reading data past the end, or before the beginning, of the intended buffer. In practice this usually happens when code trusts a length or offset value it never validated. Generic consequences of the weakness class include disclosure of sensitive memory contents or memory addresses, and crashes from invalid memory access. Those are properties of the class. None of them has been demonstrated as a technique for this specific CVE. The typical fix for this class adds bounds checks before memory is read, but Microsoft has not said which code path changed.

SQL Server is closed source, so there is no public commit or diff. The KB fix lists also do not map internal bug IDs to CVEs. The SQL Server 2025 CU10 KB lists several out-of-bounds read fixes, including:

• An out-of-bounds read in processing of certain client connection requests (SQL Connectivity)
• An out-of-bounds read in log block record parsing (Security Infrastructure)

Either could correspond to CVE-2026-66813, but nothing public ties this CVE to a specific bug ID. We are flagging these as candidates only.

CVSS breakdown

Microsoft publishes the full vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• AV:N: reachable over the network
• AC:H: additional exploitation conditions must be met
• PR:N / UI:N: the scoring vector requires no prior privileges and no user interaction
• S:U: scope unchanged
• C:H / I:H / A:H: high potential impact across all three dimensions
• E:U / RL:O / RC:C: exploit maturity Unproven, Official Fix available, report confidence Confirmed

NVD attributes the 8.1 High score to Microsoft as CNA and had not published its own assessment in the retrieved record. The impact metrics describe potential consequences; the High complexity metric describes how hard it is to get there. Neither indicates observed compromise.

The advisory's privilege model does not line up

This is the most important nuance for anyone triaging the CVE. Microsoft's advisory contains statements that do not fully agree with each other:

• The synopsis says an unauthorized attacker, and the vector says PR:N.
• One FAQ answer describes an authenticated attacker with explicit permissions who logs in to SQL Server and elevates to sysadmin.
• Another FAQ answer says successful exploitation could yield SYSTEM privileges.
• A separate answer again names SQL sysadmin.

Microsoft further states that successful exploitation requires deep system understanding, depends on environmental and configuration factors, is not guaranteed, and requires chaining other vulnerabilities to gain unauthorized access to the target environment. The advisory does not name those other vulnerabilities, does not specify which explicit permissions the authenticated scenario assumes, and does not reconcile the sysadmin versus SYSTEM outcomes.

Our reading is that the public record supports a complex privilege-escalation risk against SQL Server. It does not document a standalone unauthenticated path to SYSTEM.

Attack flow as described by Microsoft

Based only on the advisory text, the scenario Microsoft outlines looks like this:

1. The attacker obtains network reachability to a SQL Server instance running an unpatched build.
2. The attacker gains access to the target environment, which Microsoft says requires chaining other, unnamed vulnerabilities. In the authenticated FAQ scenario, the attacker logs in to SQL Server with an account holding explicit permissions.
3. The attacker triggers the out-of-bounds read in SQL Server under environment and configuration conditions that Microsoft does not detail.
4. On success, the attacker elevates to SQL sysadmin, or per one FAQ answer, SYSTEM.

No triggering request, vulnerable function, packet structure, or exploit implementation appears in the advisory, the NVD entry, or the CVE record.

Exploitation status

Microsoft frames its assessment as applying at original publication: Exploited: No, Publicly disclosed: No, Exploitation Less Likely. Senserva reports the CVE as not listed in the CISA Known Exploited Vulnerabilities catalog. We found no named threat actors, campaigns, public exploits, or indicators tied to this CVE in the reviewed material. That supports "no confirmed exploitation in reviewed reporting." It is not a guarantee that exploitation will not occur.

Patch information

Microsoft released the official fix on November 10, 2026 as part of its November SQL Server security updates. The CVSS Remediation Level is Official Fix, meaning a complete vendor fix exists rather than only a workaround.

Choosing the right package: GDR vs. CU branch

SQL Server is serviced on two parallel tracks, and you must install the update that matches the instance's current track:

• GDR (General Distribution Release): security and other broadly applicable critical fixes only, on top of the RTM baseline.
• CU+GDR: the security fix rolled into the latest Cumulative Update branch, for servers already running CUs.

Microsoft's servicing documentation notes that installing a CU moves an instance onto the CU servicing branch. Find your current build in the ranges below and install the matching KB:

To verify installation, confirm the product version reads at or above the fixed build for the branch. For SQL Server 2025 CU10, the KB states the engine moves to product version 17.0.5045.3 (file version 2025.170.5045.3).

Getting the update

Each package is offered through Windows Update / Microsoft Update, the Microsoft Update Catalog (search by KB number), and the Microsoft Download Center. The MSRC advisory links a Download Center package for each of the eight branches. The SQL Server 2025 and 2022 KBs cover both Windows and Linux. On Linux, the update is installed by upgrading the SQL Server packages from the configured CU repository.

For integrity checking, KB5129299 publishes the following SHA256 for its x64 installer package:

64AC66C63E7037F8578B3C2CB76D093E4E11F5D65951EC5545BE92AF44BEA190

These packages are cumulative security rollups. They fix many other SQL Server CVEs from the same release and include earlier servicing releases. For example, KB5129299 includes everything up through SQL Server 2025 RTM CU10 (KB5125471). The retrieved KB content did not state a restart requirement, so we are not asserting one.

Deployment caveat for KB5129299 and KB5129300

The SQL Server 2025 CU10 and SQL Server 2022 CU27 security updates document a known issue: querying sys.dm_exec_requests while a database is still recovering (during RESTORE, startup recovery, or before an availability group replica comes online) can raise an access violation and write a dump file. Microsoft attributes this to the change referencing in-memory structures before they are fully initialized, and says it is investigating a fix.

Microsoft's listed options:

• Enable trace flag 4696 to opt out of that change
• Avoid querying the DMV against databases that are recovering
• Uninstall the update

Uninstalling also removes the security fix for CVE-2026-66813, so the trace flag or adjusting monitoring queries is the better choice. With trace flag 4696 enabled, monitoring queries on secondary replicas may again return errors 976 or 978, as they did before the update. These options address the patch side effect only. Microsoft lists no vulnerability-specific workaround for the CVE itself.

Affected systems and versions

Microsoft (as CNA, reflected in NVD) lists SQL Server 2017, 2019, 2022, and 2025 as affected. On each servicing branch, any build below the fixed build is vulnerable:

• SQL Server 2017 GDR: builds below 14.0.2150.2
• SQL Server 2017 CU31+GDR: builds from 14.0.3006.16 and below 14.0.3570.2
• SQL Server 2019 GDR: builds below 15.0.2210.4
• SQL Server 2019 CU32+GDR: builds from 15.0.4003.23 and below 15.0.4510.2
• SQL Server 2022 GDR: builds below 16.0.1220.3
• SQL Server 2022 CU27+GDR2: builds from 16.0.4003.1 and below 16.0.4315.2
• SQL Server 2025 GDR: builds from 17.0.1050.2 (per NVD) and below 17.0.1155.3
• SQL Server 2025 CU10+GDR: builds below 17.0.5045.3, with Microsoft's KB applicability range starting at 17.0.4006.2

SQL Server runs on Windows, Linux, Linux containers, and virtual machines, but deployment options alone do not determine exposure. The affected releases and branches are those listed above. Package prerequisites are defined in each KB article and are not identical to the affected version intervals.

Vendor security history

SQL Server is a prominent platform. DB-Engines ranks it third in popularity in November 2026 (score 693.53), which is a popularity measure, not market share or a security rating.

The most cited historical SQL Server incident is SQL Slammer. CERT VU#484891 documents a remotely exploitable stack buffer overflow in the SQL Server 2000 Resolution Service, and Microsoft's MS02-039 bulletin states its patch protects SQL Server 2000 and MSDE 2000 against the worm. The U.S. GAO reports the patch shipped in July 2002, yet Slammer still caused a global Internet slowdown and outages on January 25, 2003. The lesson there is about patch deployment rather than mechanism. Nothing indicates CVE-2026-66813 is wormable or related to Slammer.

In the current cycle, Qualys counts 59 SQL Server vulnerabilities and 13 distinct updates in its November 2026 Patch Tuesday review. Those figures reflect a large maintenance release, not a comparative defect rate.

References

• Microsoft Security Update Guide: CVE-2026-66813
• NVD: CVE-2026-66813
• CVE Record: CVE-2026-66813
• Microsoft Support: KB5129299
• KB5129299: Security update for SQL Server 2025 CU10
• KB5129300: Security update for SQL Server 2022 CU27
• KB5132749: Security update for SQL Server 2017 GDR
• Microsoft Learn: Updates to the Microsoft Update detection logic for SQL Server
• MITRE CWE-125: Out of bounds Read
• Senserva: CVE-2026-66813
• Casco: CVE-2026-66813
• Qualys: Microsoft Patch Tuesday, November 2026 Security Update Review
• CISA Known Exploited Vulnerabilities Catalog
• Microsoft Learn: What Is SQL Server?
• DB-Engines Ranking
• CERT VU#484891: SQL Server 2000 Resolution Service stack buffer overflow
• Microsoft Security Bulletin MS02-039
• GAO: Continued Action Needed to Improve Software Patch Management