Brief Summary: Microsoft SQL Server CVE-2026-67391 Heap-Based Buffer Overflow Enabling Authenticated Remote Code Execution

Introduction

Microsoft's November 10, 2026 SQL Server security release fixes a heap-based buffer overflow that lets a user holding only a valid low-privilege login execute code on the database server over the network. SQL Server instances typically hold an organization's most sensitive data and accept connections from many application and user accounts. A bug that turns an ordinary login into code execution on the engine host warrants prompt, branch-accurate patching.

Technical Information

Classification and scoring. MSRC tracks CVE-2026-67391 as a Microsoft SQL Server Remote Code Execution Vulnerability, rated Important and classified as CWE 122 (Heap based Buffer Overflow). The CVSS 3.1 base score is 8.8 and the temporal score is 7.7, with the vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

The vector says the bug is reachable over the network (AV:N), attack complexity is low (AC:L), the attacker needs a valid low-privilege login (PR:L), no user interaction is required (UI:N), and confidentiality, integrity, and availability impacts are all high. The temporal metrics mark exploit maturity as Unproven (E:U) and remediation as an Official Fix (RL:O), which MSRC defines as "a complete vendor solution is available." An unauthenticated attacker cannot reach the bug. The privilege requirement is the main gating factor.

Root cause. CWE 122 describes a product writing beyond the end of a buffer allocated on the heap. The MSRC FAQ states that an authenticated attacker with low-level access can connect to an affected SQL Server and submit "a specially crafted query or request" that corrupts memory and allows code execution on the server. A patch for this class of bug normally adds bounds checks before data is copied into a heap allocation. Microsoft has not disclosed the vulnerable function, the query syntax, the memory layout, or a reproduction procedure, and we are not going to guess at them.

Attack flow, as described by Microsoft.

1. The attacker obtains a valid low-privilege login to the target SQL Server instance.
2. The attacker connects to the instance over the network.
3. The attacker submits a specially crafted query or request.
4. The engine writes past the end of a heap buffer, corrupting memory.
5. The attacker uses the corruption to execute code on the server, with no action required from any other user.

Candidate fixes in the November KBs. SQL Server is closed source, so there is no public commit or diff. Microsoft's KB articles list one combined set of fixes covering 30+ SQL Server CVEs and do not map internal fixes to CVE IDs. Several entries in the KB5129299 (2025 CU10) and KB5132749 (2017 GDR) tables match the heap overflow weakness class:

• "Fixes a heap buffer overflow during XML operation" (SQL Server Engine, Programmability; Linux and Windows)
• "Fixes a heap buffer overflow that can occur in the Log Reader Agent" (Replication)
• A buffer overflow in merge replication when more than 250 WebSync XML nickname entries are processed (2025 KB)
• Replication queue parameter validation that now rejects "boundary strings that exceed the WCHAR conversion buffer" (2017 KB)
• Bounded validation in Merge Replication error source parsing, and stricter validation of variable-length column offsets and sparse column data

Any of these could be the CVE-2026-67391 fix, but Microsoft has not confirmed which one. ZDI's November review counts 24 heap buffer overflows among the SQL Server-related CVEs in the same release, which is another reason to install the whole update rather than reasoning about individual fixes.

Patch Information

Microsoft fixed CVE-2026-67391 in its November 10, 2026 SQL Server security release. The fix ships only as binary updates on two servicing tracks, and you must pick the one that matches your installed build:

• GDR (General Distribution Release): security fixes and other broadly applicable critical fixes only, for instances still on the RTM/GDR baseline.
• CU+GDR: the same security fix applied on top of the latest Cumulative Update, for instances that follow the CU train.

Microsoft's guidance is to look up the current product version, find the range it falls in, and install the update listed for that range:

• KB5129299, SQL Server 2025 CU10+GDR: fixed build 17.0.5045.3; apply if current version is 17.0.4006.2 to 17.0.5035.5
• KB5132748, SQL Server 2025 RTM+GDR: fixed build 17.0.1155.3; apply if current version is 17.0.1000.7 to 17.0.1145.4
• KB5129300, SQL Server 2022 CU27+GDR2: fixed build 16.0.4315.2; apply if current version is 16.0.4003.1 to 16.0.4305.5
• KB5132747, SQL Server 2022 RTM+GDR: fixed build 16.0.1220.3; apply if current version is 16.0.1000.6 to 16.0.1210.3
• KB5132745, SQL Server 2019 CU32+GDR: fixed build 15.0.4510.2; apply if current version is 15.0.4003.23 to 15.0.4500.2
• KB5132751, SQL Server 2019 RTM+GDR: fixed build 15.0.2210.4; apply if current version is 15.0.2000.5 to 15.0.2200.2
• KB5132746, SQL Server 2017 CU31+GDR: fixed build 14.0.3570.2; apply if current version is 14.0.3006.16 to 14.0.3560.2
• KB5132749, SQL Server 2017 RTM+GDR: fixed build 14.0.2150.2; apply if current version is 14.0.1000.169 to 14.0.2140.2

Cumulative within branch. The MSRC table lists each package as including earlier servicing releases. For example, KB5129299 includes KB5125471 (SQL 2025 RTM CU10), and KB5132749 includes the previous SQL 2017 RTM GDR (KB5128497). You can skip missed monthly GDRs and go straight to the November build.

Obtaining the update.

• Windows: Windows Update / Microsoft Update, the Microsoft Update Catalog (search the KB number), or standalone packages from the Microsoft Download Center. Microsoft notes that an administrator must opt in to Microsoft Update for SQL Server updates to appear in the Windows Update applet, and points systems without internet or WSUS access to the Download Center.
• Linux: the same builds fix SQL Server on Linux. For SQL Server 2025 on Linux, configure the Cumulative Update repository and update the SQL Server packages with your distribution's package manager.

Package integrity. The KBs publish SHA256 hashes. The SQL Server 2025 KB5129299 x64 package hash is 64AC66C63E7037F8578B3C2CB76D093E4E11F5D65951EC5545BE92AF44BEA190, and the SQL Server 2017 KB5132749 x64 package hash is D5583711DC58E747BD96C521635747D0C59D1255DE94B355A545A472DC541329.

Verification. After installing, confirm the instance reports the fixed product version:

SELECT SERVERPROPERTY('ProductVersion');

KB5129299 brings SQL Server 2025 to 17.0.5045.3 (file version 2025.170.5045.3). KB5132749 brings SQL Server 2017 to 14.0.2150.2 (file version 2017.140.2150.2). Anything below the fixed build for its branch is still vulnerable. NVD expresses affected ranges as ending just below these builds, for example SQL Server 2022 GDR 16.0.0 < 16.0.1220.3.

Known issue: sys.dm_exec_requests regression. KB5129299 (2025 CU10+GDR) documents a regression, and the KB5129300 (2022 CU27+GDR2) article documents the same behavior. Queries against sys.dm_exec_requests can raise an EXCEPTION_ACCESS_VIOLATION and write a dump file if they run while a database is still recovering: during a RESTORE, during startup recovery, or before an availability group replica comes online. Microsoft says a change causes internal structures to be "referenced before they're fully initialized" and is working on a fix. Interim options:

1. Enable trace flag 4696 to opt out of the change. Monitoring queries on secondaries may then return errors 976/978 again, as before the update.
2. Avoid querying sys.dm_exec_requests against databases that are recovering.
3. Uninstall the update.

Uninstalling also removes the CVE-2026-67391 fix, so trace flag 4696 or adjusting monitoring queries is the better choice. Pay particular attention to monitoring tools that poll DMVs on availability group secondaries.

Detection Methods

Current state. Exploit maturity is Unproven, Senserva's tracker reports no confirmed in-the-wild exploitation, and the CVE is not on CISA KEV. No public Sigma, YARA, Snort/Suricata, or vendor hunting rules exist for this CVE, and no IoCs have been published. Detection today means finding vulnerable builds plus general monitoring for authenticated attackers.

1. Sweep by build number. This is the most reliable check available. Read each instance's build using the ProductVersion server property or @@VERSION, then compare it against the fixed build for that instance's major version and channel in the Patch Information list above. The 2022 and 2019 KBs apply to both Windows and Linux builds, so include Linux hosts in the sweep.

Windows hotfix inventory will not find this. Senserva points out that these are SQL Server product updates, not Windows components, so the PowerShell hotfix listing cmdlet does not show them. A scan that only looks for installed Windows KBs can report a host as clean when it is not. Check the SQL Server build number itself.

2. Use your vulnerability scanner. Rapid7's vulnerability database covers CVE-2026-67391 for Microsoft SQL Server (added November 10, 2026), with remediation checks for 2017 CU31/GDR, 2019 CU32/GDR, 2022 CU27/GDR, and 2025 CU10/GDR. Authenticated scans with current content should flag unpatched engines. Make sure the scanner can query the database engine or read its installed version. Port reachability alone is not enough.

3. Hunting without signatures. Because the attacker needs a valid login, focus monitoring on who can authenticate to SQL Server and what those principals do:

• New or unusual low-privilege logins connecting to exposed instances
• Logins coming from unexpected hosts
• Repeated sessions that end abnormally

A heap overflow that fails often crashes the engine, so treat these as possible signs of a failed attempt on an unpatched server:

• Unexpected SQL Server service crashes or restarts
• New stack dump files in the SQL Server log folder

These are investigative leads only. No public source ties a specific crash signature to this CVE. The heap overflow entries in the KB fix lists (XML operations, Log Reader Agent) can help you decide which features to watch more closely, but do not assume any of them is this CVE.

4. Do not mistake the patch's known issue for an attack. The sys.dm_exec_requests regression described above produces dumps during database recovery. Microsoft's example error log shows SqlDumpExceptionHandler and an access violation in the sqlmin module. If you alert on engine crashes, correlate these dumps with recovery events and monitoring queries before treating them as attacks.

A build-number sweep against the fixed builds, backed by scanner coverage, is the best detection available. Behavioral monitoring of authenticated sessions and engine crashes adds context but is not a CVE-specific signature.

Affected Systems and Versions

Microsoft SQL Server on Windows and Linux, in the following ranges:

• SQL Server 2025 CU branch: 17.0.4006.2 through 17.0.5035.5 (fixed in 17.0.5045.3)
• SQL Server 2025 RTM/GDR branch: 17.0.1000.7 through 17.0.1145.4 (fixed in 17.0.1155.3)
• SQL Server 2022 CU branch: 16.0.4003.1 through 16.0.4305.5 (fixed in 16.0.4315.2)
• SQL Server 2022 RTM/GDR branch: 16.0.1000.6 through 16.0.1210.3 (fixed in 16.0.1220.3)
• SQL Server 2019 CU branch: 15.0.4003.23 through 15.0.4500.2 (fixed in 15.0.4510.2)
• SQL Server 2019 RTM/GDR branch: 15.0.2000.5 through 15.0.2200.2 (fixed in 15.0.2210.4)
• SQL Server 2017 CU branch: 14.0.3006.16 through 14.0.3560.2 (fixed in 14.0.3570.2)
• SQL Server 2017 RTM/GDR branch: 14.0.1000.169 through 14.0.2140.2 (fixed in 14.0.2150.2)

Exploitation requires network access to the instance and a valid low-privilege login. Match the installed build to its servicing branch rather than selecting an update by product year alone.

References

• NVD entry for CVE-2026-67391
• CVE.org record for CVE-2026-67391
• MSRC Security Update Guide: Microsoft SQL Server Remote Code Execution Vulnerability
• KB5129299: SQL Server 2025 CU10+GDR, November 2026
• KB5129299 help page
• KB5132748: SQL Server 2025 RTM+GDR
• KB5129300: SQL Server 2022 CU27+GDR, November 2026
• KB5132747: SQL Server 2022 RTM+GDR
• KB5132745: SQL Server 2019 CU32+GDR, November 2026
• KB5132751: SQL Server 2019 RTM+GDR
• KB5132746: SQL Server 2017 CU31+GDR
• KB5132749: SQL Server 2017 GDR, November 2026
• Zero Day Initiative: The November 2026 Security Update Review
• Rapid7 Vulnerability Database entry
• Senserva: KB5132746
• Senserva: KB5129300
• Microsoft Learn: SQL Server Security Best Practices
• Microsoft Learn: Securing SQL Server
• Microsoft Learn: Install SQL Server Servicing Updates
• MITRE CWE 122: Heap based Buffer Overflow
• DB Engines Ranking
• DB Engines: Microsoft SQL Server System Properties