Introduction
Microsoft's November 2026 Patch Tuesday release fixed a heap-based buffer overflow in SQL Server. An authenticated login, even one with low privileges, can send a crafted query or request that corrupts server memory and leads to code execution on the database host. SQL Server instances usually sit at the center of application stacks and hold the data those applications depend on, so a path from an ordinary database login to code execution on the server deserves prompt attention, even though Microsoft currently rates exploitation as Less Likely.
Technical information
Root cause
Microsoft classifies CVE-2026-67374 as CWE 122, heap-based buffer overflow. CWE describes this weakness as writing past the end of a buffer allocated on the heap. Such errors can crash a process, and in some cases heap overflows can be used to execute arbitrary code. For this CVE, Microsoft explicitly states the impact is remote code execution.
Accurate triage also depends on what the advisory leaves out. The public MSRC entry does not identify the affected internal component, the memory layout involved, the vulnerable query syntax, or a reproducible trigger. SQL Server is closed source, so there is no public commit or diff to inspect. The fix ships only as patched binaries, and the evidence for it is Microsoft's advisory, its KB articles, and the fixed build numbers. In general, a fix for this class of bug adds bounds or length checks before data is copied into a heap allocation, so oversized input is rejected or truncated rather than overwriting adjacent memory.
The November KB fix lists contain several heap overflow corrections that would plausibly fit:
- A heap buffer overflow during XML operations (Programmability; Linux and Windows)
- A heap buffer overflow that can occur in the Log Reader Agent (Replication)
- A buffer overflow in merge replication WebSync XML nickname handling (in the 2022 and 2025 KBs)
Microsoft does not say which internal bug ID corresponds to CVE-2026-67374, so none of these should be treated as the confirmed root cause. The mapping is unknown.
Attack flow
Based on Microsoft's description, the disclosed attack path looks like this:
- The attacker holds a valid SQL Server login. Only low privileges are required.
- The attacker connects to an affected SQL Server instance over the network.
- The attacker submits a specially crafted query or request.
- While processing that input, the server writes past the end of a heap buffer, corrupting memory.
- Per Microsoft, that corruption can be leveraged to execute code on the server. No action by any other user is required.
The advisory does not describe an unauthenticated route, a specific payload, or a privilege escalation chain, and none should be inferred.
Scoring
The CVSS 3.1 base vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which yields a base score of 8.8 (High):
- AV:N: reachable over the network
- AC:L: low attack complexity
- PR:L: low privileges required
- UI:N: no user interaction
- S:U: unchanged scope
- C:H / I:H / A:H: high confidentiality, integrity, and availability impact
Microsoft's temporal score is 7.7, reflecting Exploit Code Maturity Unproven, Remediation Level Official Fix, and Report Confidence Confirmed. Microsoft's own severity rating is Important, while the CVSS base rating is High. Keep the two distinct when triaging. FIRST's specification describes the base score as reflecting intrinsic characteristics and a reasonable worst case, and recommends supplementing it with temporal and environmental context.
The NVD record was marked Awaiting Enrichment and showed no NIST score assessment at the time of review, so the Microsoft advisory is the primary technical record.
Exploitation status
At original publication, Microsoft's exploitability assessment was:
- Publicly disclosed: No
- Exploited: No
- Exploitation: Less Likely
A separate third-party record reported the CVE was not in the CISA Known Exploited Vulnerabilities catalog as of November 10, 2026. Absence from that catalog is not proof that exploitation has never occurred. The sources we reviewed identify no threat actor, campaign, indicators of compromise, or verified public proof of concept, so there is no attribution to report. Treat Microsoft's assessment as a snapshot taken at publication rather than a permanent status.
Microsoft credited Sharath Unni, Team Menace, DQP with Viettel Cyber Security, yhw and txz, Pwnforr777, Andrew Ruddick, and Microsoft Red Team in the acknowledgements. That section does not include a technical description.
Patch information
Microsoft fixed CVE-2026-67374 in its November 10, 2026 SQL Server security updates. The MSRC advisory sets the CVSS Remediation Level to Official Fix, and Microsoft's stated action is to install the applicable security update. No separate workaround for the vulnerability itself was published.
One package per servicing branch
SQL Server is maintained on two tracks:
- GDR (General Distribution Release): security and critical fixes only
- CU (Cumulative Update): all accumulated fixes for the release
Microsoft released a separate package for each track of each supported version. Install the package that matches the track the server is already on. The product year alone is not enough to choose correctly.
- SQL Server 2025 CU10+GDR: KB5129299, fixed build 17.0.5045.3
- SQL Server 2025 RTM+GDR: KB5132748, fixed build 17.0.1155.3
- SQL Server 2022 CU27+GDR2: KB5129300, fixed build 16.0.4315.2
- SQL Server 2022 RTM+GDR: KB5132747, fixed build 16.0.1220.3
- SQL Server 2019 CU32+GDR: KB5132745, fixed build 15.0.4510.2
- SQL Server 2019 RTM+GDR: KB5132751, fixed build 15.0.2210.4
- SQL Server 2017 CU31+GDR: KB5132746, fixed build 14.0.3570.2
- SQL Server 2017 RTM+GDR: KB5132749, fixed build 14.0.2150.2
Verifying the fix
The KB summaries for SQL Server 2025 CU10 (KB5129299), 2022 CU27 (KB5129300), and 2017 GDR (KB5132749) each list CVE-2026-67374 among the resolved vulnerabilities. To confirm a server is patched, check its ProductVersion, which should be at or above the fixed build for its branch. For example, SQL Server 2025 CU10 should report product version 17.0.5045.3 (file version 2025.170.5045.3).
The update is published for Windows and Linux. On Windows it is available through Windows Update, the Microsoft Update Catalog, and the Microsoft Download Center. On Linux it comes from the configured CU package repository, installed with the appropriate platform update command as described in the KB.
These are bundled packages. The same installs also address many other November 2026 SQL Server CVEs, including other remote code execution, elevation of privilege, and information disclosure issues.
Known regression
The SQL Server 2025 CU10 and SQL Server 2022 CU27 KBs document a side effect. Querying sys.dm_exec_requests while a database is recovering (including during RESTORE, startup recovery, or before an availability group replica is online) can raise an access violation and generate a dump file. Microsoft lists these workarounds for the regression:
- Enable trace flag 4696 to turn off the change that causes it
- Avoid those queries against databases that are recovering
- Uninstall the update
These address the regression, not CVE-2026-67374. Uninstalling the update also removes the security fix, so trace flag 4696 or avoiding the queries is the safer route if your monitoring or recovery workflows touch that DMV.
Affected systems and versions
Per the MSRC advisory, the following installed build ranges are affected, and each is fixed by the listed build. The affected ranges published on NVD (supplied by Microsoft as the CNA) match these: every listed branch is vulnerable below its fixed version.
- SQL Server 2025 CU branch: 17.0.4006.2 through 17.0.5035.5 (fixed in 17.0.5045.3, KB5129299)
- SQL Server 2025 GDR branch: 17.0.1000.7 through 17.0.1145.4 (fixed in 17.0.1155.3, KB5132748)
- SQL Server 2022 CU branch: 16.0.4003.1 through 16.0.4305.5 (fixed in 16.0.4315.2, KB5129300)
- SQL Server 2022 GDR branch: 16.0.1000.6 through 16.0.1210.3 (fixed in 16.0.1220.3, KB5132747)
- SQL Server 2019 CU branch: 15.0.4003.23 through 15.0.4500.2 (fixed in 15.0.4510.2, KB5132745)
- SQL Server 2019 GDR branch: 15.0.2000.5 through 15.0.2200.2 (fixed in 15.0.2210.4, KB5132751)
- SQL Server 2017 CU branch: 14.0.3006.16 through 14.0.3560.2 (fixed in 14.0.3570.2, KB5132746)
- SQL Server 2017 GDR branch: 14.0.1000.169 through 14.0.2140.2 (fixed in 14.0.2150.2, KB5132749)
The KBs cover both Windows and Linux deployments. Exploitation requires network access to the instance and a valid low-privileged login. Check each server's installed version and servicing path against these ranges and the KB prerequisites before selecting a package.
Vendor security history
SQL Server is a relational database management system that Microsoft supports on Windows, Linux, Linux containers, and Azure or other virtual machines. DB Engines ranked it third in its November 2026 popularity ranking, which measures popularity, not market share.
On Microsoft's broader track record, the Cyber Safety Review Board's review of the Summer 2023 Exchange Online intrusion found that the intrusion was preventable, concluded that Microsoft's security culture was inadequate, and cited a series of avoidable errors along with Microsoft's failure to detect the compromise of its cryptographic key without customer help. That report concerns Exchange Online, not SQL Server, and says nothing about the cause or handling of this CVE.
Microsoft's July 2026 Secure Future Initiative progress report describes actions the company says it has taken, including decommissioning 1.4 million unused Entra applications, broadly enforcing Zero Trust for source code access, remediating more than 550,000 instances of critical and high-risk open-source vulnerabilities, automating container patching that addresses about 3 million vulnerability instances monthly, and publishing 1,989 CVEs with CWE and CPE annotations. These are self-reported claims rather than an independent evaluation, and they do not change the patch requirement for this vulnerability.
References
- Microsoft Security Update Guide: CVE-2026-67374
- NVD entry for CVE-2026-67374
- CVE Record for CVE-2026-67374
- KB5129299: SQL Server 2025 CU10 GDR, November 2026 (servicing page)
- KB5129300: SQL Server 2022 CU27 GDR, November 2026 (servicing page)
- KB5132749: SQL Server 2017 GDR, November 2026 (servicing page)
- KB5129299: Security update for SQL Server 2025 CU10
- KB5132748: Security update for SQL Server 2025 GDR
- KB5129300: Security update for SQL Server 2022 CU27
- KB5132747: Security update for SQL Server 2022 GDR
- KB5132745: Security update for SQL Server 2019 CU32
- KB5132751: Security update for SQL Server 2019 GDR
- KB5132746: Security update for SQL Server 2017 CU31
- KB5132749: Security update for SQL Server 2017 GDR
- CWE 122: Heap Based Buffer Overflow
- CVSS v3.1 Specification Document (FIRST)
- Zero Day Initiative: The November 2026 Security Update Review
- Senserva record for CVE-2026-67374
- Microsoft Learn: What Is SQL Server?
- DB Engines Ranking
- Cyber Safety Review Board: Review of the Summer 2023 Microsoft Exchange Online Intrusion
- Microsoft Secure Future Initiative Progress Report, July 2026
