Brief Summary: CVE-2026-67375, a SQL Server Stack Buffer Overflow Enabling Escalation to sysadmin

Introduction

A memory corruption flaw patched in Microsoft SQL Server during the November 2026 Patch Tuesday release lets an authenticated login with low privileges become sysadmin over the network. In practice, a single low-trust application or reporting account on an affected instance can be turned into full administrative control of the database server, with high impact to confidentiality, integrity, and availability.

Microsoft tracks the issue as CVE-2026-67375, a stack-based buffer overflow (CWE-121) with a CVSS 3.1 base score of 8.8 and a severity rating of Important. This post is a short review of what the public advisories say, what they leave out, and how to pick the correct update for your servicing branch.

Technical information

Root cause

Microsoft describes the bug as a stack-based buffer overflow in SQL Server that allows an authorized attacker to elevate privileges over a network. MITRE's CWE-121 defines this weakness as a condition where data is written past the end of a buffer allocated on the stack. Overflows of this class typically corrupt adjacent stack memory, which is how an attacker can influence program state beyond what their permissions allow.

SQL Server is closed source, and Microsoft has not published the vulnerable component, the specific input or operation that triggers the overflow, or an exploitation chain. We have not assumed any mechanism more specific than what the advisory states.

What the fix tables hint at

Each November 2026 SQL Server update bundles fixes for about 37 SQL Server CVEs, and Microsoft does not say which bug reference line in the KB fix tables belongs to which CVE. Several of the listed fixes add bounds checks and input validation, for example:

• bounded validation for Merge Replication error source parsing
• a buffer overflow fix for merge replication processing more than 250 WebSync XML nickname entries
• tighter validation of transaction identifiers in replication

These match the usual remedy for a stack overflow: check the length before copying into a fixed-size buffer on the stack. However, the exact code location fixed for CVE-2026-67375 has not been publicly confirmed, so none of these line items should be treated as the fix for this CVE.

Severity breakdown

Microsoft and NVD describe the CVSS 3.1 vector as follows:

• Attack vector: Network
• Attack complexity: Low
• Privileges required: Low
• User interaction: None
• Scope: Unchanged
• Confidentiality, integrity, availability impact: High, High, High
• Base score: 8.8 (High); temporal score: 7.7
• Remediation level: Official Fix, meaning Microsoft considers the update a complete vendor fix

Because the vector requires low privileges, an attacker needs a valid login first. This is not a pre-authentication bug.

Attack flow

Based on the MSRC FAQ, the attack proceeds as follows:

1. The attacker obtains a SQL Server login that has explicit permissions on the instance, for example a compromised application or user account with low privileges.
2. The attacker connects to SQL Server over the network and authenticates with that login.
3. The attacker triggers the stack-based buffer overflow through an operation that Microsoft has not publicly identified. No user interaction is required.
4. Successful exploitation elevates the attacker to sysadmin on the instance. The MSRC FAQ also mentions SYSTEM-level privileges.

Exploitation status

At original publication, Microsoft listed the issue as "Exploited: No," "Publicly disclosed: No," and "Exploitation Less Likely," noting that no publicly available exploit code exists or the exploit is theoretical. No threat actor or campaign has been attributed. A secondary tracker, Senserva, reported no observed exploitation as of November 10, 2026 and noted that the CVE was not in the CISA Known Exploited Vulnerabilities catalog at that time. Both are point-in-time assessments and do not cover later activity.

Patch information

Microsoft fixed CVE-2026-67375 in the November 10, 2026 Patch Tuesday release. Because SQL Server is closed source, there is no public commit or diff. The fix ships as compiled binaries in two SQL Server 2025 updates. Pick the one that matches your servicing branch:

SQL Server 2025 RTM + GDR: KB5132748

• Fixed build: 17.0.1155.3 (file version 2025.170.1155.3)
• Apply if the current build is 17.0.1000.7 through 17.0.1145.4
• Platforms: Windows and Linux

SQL Server 2025 CU10 + GDR: KB5129299

• Fixed build: 17.0.5045.3 (file version 2025.170.5045.3)
• Apply if the current build is 17.0.4006.2 through 17.0.5035.5
• Platforms: Windows and Linux

Both KB articles name CVE-2026-67375 among the vulnerabilities they fix. The MSRC Security Updates table lists KB5132748 (build 17.0.1155.3) for SQL Server 2025 on x64 systems (GDR). NVD's CNA data describes the affected range as 17.0.1050.2 < 17.0.1155.3, so 17.0.1155.3 is the first fixed build on the GDR branch.

GDR or CU?

SQL Server is serviced on two parallel tracks. GDR updates carry only security and other broadly applicable critical fixes, while CU updates carry every accumulated fix for the release. The two are not interchangeable, so select by version range rather than by product year:

• A server still on the RTM/GDR line gets KB5132748.
• A server already on a CU (up to CU10) gets KB5129299.
• Installing the CU package on a GDR server also moves that server onto the CU track.

Getting the update

• Windows Update / Microsoft Update: delivered automatically when automatic updating is enabled.
• Microsoft Update Catalog: search for KB5132748 or KB5129299 to get the standalone package.
• Microsoft Download Center: the KB5132748 x64 installer has SHA256 CB08B7AB9D18CC6DC16FF519DCFBD4316D0D6275A1B1FAC7EE021BBD9BC69086. The KB5129299 x64 installer has SHA256 64AC66C63E7037F8578B3C2CB76D093E4E11F5D65951EC5545BE92AF44BEA190.
• Linux: update the SQL Server packages from the configured Microsoft repository. For CU10 + GDR, the CU repository must be configured.

Verifying the build

After installing, confirm the build is at least 17.0.1155.3 (GDR) or 17.0.5045.3 (CU):

SELECT @@VERSION;
SELECT SERVERPROPERTY('ProductVersion');

Known issue with KB5129299 (CU10 + GDR)

Querying sys.dm_exec_requests while a database is still recovering can cause an access violation and a dump. This can happen during RESTORE, startup recovery, or while an availability group replica comes online. Microsoft is investigating a fix and, until then, suggests trace flag 4696 or avoiding those queries during recovery. Plan for this before rolling the CU + GDR package onto availability group or monitoring-heavy servers.

The Microsoft materials reviewed do not describe any CVE-specific temporary workaround. The security update is the remediation.

Affected systems and versions

The advisory's product listing and NVD's affected product data name SQL Server 2025 for this CVE, on both Windows and Linux:

• SQL Server 2025 RTM/GDR branch: builds 17.0.1000.7 through 17.0.1145.4 are in the applicable range for KB5132748. NVD's CNA data expresses the affected range as starting at 17.0.1050.2 and ending before 17.0.1155.3.
• SQL Server 2025 CU branch: builds 17.0.4006.2 through 17.0.5035.5 (up to CU10) are in the applicable range for KB5129299.

Scope note: the MSRC FAQ prints a general November 2026 update table that also covers SQL Server 2022, 2019, and 2017, while the advisory's product listing and NVD name only SQL Server 2025. Administrators running older SQL Server generations should check the MSRC Security Update Guide entry directly to confirm whether the update applies to their installed build, rather than relying on the narrower listing alone.

References

• MSRC Security Update Guide: CVE-2026-67375, Microsoft SQL Server Elevation of Privilege Vulnerability (en-US)
• MSRC Security Update Guide: CVE-2026-67375
• NVD: CVE-2026-67375
• Microsoft Support: KB5132748
• Microsoft Support: KB5129299
• KB5129299: Description of the security update for SQL Server 2025 CU10, November 10, 2026
• KB5129300: Description of the security update for SQL Server 2022 CU27, November 10, 2026
• Zero Day Initiative: The November 2026 Security Update Review
• Senserva: CVE-2026-67375 tracker entry
• MITRE CWE-121: Stack Based Buffer Overflow
• DB-Engines Ranking
• Microsoft Security Response Center