Introduction
Microsoft's November 10, 2026 SQL Server security updates fix a heap buffer overflow that lets an attacker holding a valid, low-privileged SQL login execute code on the database server over the network. The fix spans SQL Server 2017, 2019, 2022 and 2025 across eight separate GDR and CU packages, so for most teams the practical work is matching every instance to the correct servicing branch and confirming the resulting build.
Technical Information
Root cause
CVE-2026-67632 is classified as CWE-122, Heap-based Buffer Overflow. MITRE defines this weakness as writing beyond the end of a buffer allocated on the heap. The general consequences of the class include crashes and, in more controlled cases, unauthorized code execution or memory modification, for example by overwriting function pointers stored near the overflowed allocation. Those consequences describe the weakness class in general. They do not come from any published reconstruction of this specific SQL Server bug.
Microsoft's own description is short: "Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network." The MSRC FAQ adds that an authenticated attacker with low privileges can connect to an affected instance and send a specially crafted query or request that corrupts memory and runs code on the server, with no user interaction needed.
CVSS breakdown
Microsoft, acting as the CNA, published the following CVSS 3.1 vector (score 8.8, High):
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack vector, Network: exploitable remotely.
- Attack complexity, Low.
- Privileges required, Low: some authorization is required, so this is not unauthenticated exploitation, but administrator rights are not implied either.
- User interaction, None.
- Scope, Unchanged.
- Confidentiality, Integrity, Availability: High.
NVD lists the record as awaiting analysis, so these values are Microsoft's assessment rather than an independent NIST score. They describe access requirements and consequences, not a specific SQL permission, command or payload.
Which code path? Candidate fixes in the November bundles
SQL Server is closed source, so there is no public commit or diff. Each November release bundles more than 30 SQL Server CVEs, and the KB articles do not say which internal bug fix belongs to which CVE. The fix tables do contain several heap overflow entries that match this bug class:
- "Fixes a heap buffer overflow during XML operation" (SQL Server Engine, Programmability; Linux and Windows). It appears on every branch, for example bug 5622178 in 2022 CU27, 5622180 in 2022 GDR, 5622181 in 2019 CU32, 5622185 in 2017 GDR and 5622177 in 2025 GDR.
- "Fixes a heap buffer overflow that can occur in the Log Reader Agent" (Replication, Windows), for example bug 5723292 in 2022 CU27 and 5723277 in 2019 CU32.
- A buffer overflow in merge replication when it processes more than 250 WebSync XML nickname entries (2022 and 2025 branches).
We infer, without any attribution from Microsoft, that an authenticated, network-reachable heap overflow fits an engine code path that a low-privileged login can drive with Transact SQL, and the XML operation fix fits that profile best. Fixes of this kind are the usual memory-safety repair, where the engine checks that data fits in the heap buffer it allocated before copying into it and rejects input that does not fit. Do not treat any single entry above as confirmed to be the CVE-2026-67632 flaw.
Attack flow
Based only on what Microsoft has published, exploitation follows this general sequence:
- The attacker obtains a valid, authenticated SQL login. According to the CVSS vector, low privileges are enough.
- The attacker connects to an affected SQL Server instance over the network.
- The attacker sends a specially crafted query or request to the engine.
- Processing that input overflows a heap buffer, corrupting memory in the server process.
- The attacker uses the corruption to execute code on the server, with high impact on confidentiality, integrity and availability.
The public records do not identify the affected function, the malformed input format, the request sequence, the required database role, the identity under which code runs, or any memory protection bypass. We therefore cannot point to a specific statement, port or exploit chain.
Exploitation status
The CISA SSVC assessment embedded in the NVD record (timestamp 2026-11-10T21:21:03.654500Z) records exploitation as "none", automatable as "no" and technical impact as "total". MSRC rates the issue Exploitation Unlikely, not publicly disclosed and not exploited. Senserva reports no CISA KEV inclusion as of November 10, 2026 and no EPSS score. No threat actor, campaign or public proof of concept has been tied to this CVE. The "automatable: no" and "attack complexity: low" ratings answer different questions, and neither cancels the other.
Patch Information
Microsoft fixed CVE-2026-67632 in its November 10, 2026 SQL Server security updates. All eight KB pages are dated November 10, 2026, and each lists "CVE-2026-67632 - Microsoft SQL Server Remote Code Execution Vulnerability" in its Summary. The upper bound of each NVD version range matches the build number of one of these KBs.
GDR versus CU plus GDR
Microsoft ships each security fix on two parallel branches, and you install the package that matches the branch you already run:
- GDR (General Distribution Release): security fixes only, for instances that stayed on the RTM baseline.
- CU plus GDR: the same security fixes applied on top of the latest Cumulative Update, for instances that track CUs.
That is why one CVE maps to eight packages.
Fixed builds
- SQL Server 2025 CU10: KB5129299, fixed build 17.0.5045.3
- SQL Server 2025 GDR: KB5132748, fixed build 17.0.1155.3
- SQL Server 2022 CU27: KB5129300, fixed build 16.0.4315.2 (file version 2022.160.4315.2)
- SQL Server 2022 GDR: KB5132747, fixed build 16.0.1220.3 (file version 2022.160.1220.3)
- SQL Server 2019 CU32: KB5132745, fixed build 15.0.4510.2
- SQL Server 2019 GDR: KB5132751, fixed build 15.0.2210.4
- SQL Server 2017 CU31: KB5132746, fixed build 14.0.3570.2
- SQL Server 2017 GDR: KB5132749, fixed build 14.0.2150.2
Installing the update
Every KB offers the same three delivery channels:
- Windows Update or Microsoft Update (automatic).
- Microsoft Update Catalog (standalone package).
- Microsoft Download Center. For example, the SQL Server 2022 KB5129300 x64 package has SHA256
07C854F949CEBA92B43BC08A726AC819545C9CBD11C2B765FF578485FE219F52.
On Linux, update the mssql-server packages from the configured CU repository. Because CU packages are cumulative, any 2022 CU through CU27 can take KB5129300, and any 2019 CU can take KB5132745. Review each KB's stated prerequisites before deployment.
Known regression in 2022 CU27 and 2025 CU10
The KB5129300 and KB5129299 updates have a known issue. Queries against sys.dm_exec_requests can raise an access violation and generate a dump if they run while a database is still recovering, for example during RESTORE, startup recovery, or before an AG replica comes online. Microsoft's listed workarounds are:
- Enable trace flag 4696 to opt out of the change that causes it.
- Avoid querying that DMV against recovering databases.
- Uninstall the update.
Plan for this on monitoring-heavy Availability Group deployments. Trace flag 4696 addresses only the regression and does not replace the CVE fix. Uninstalling the update also removes the CVE-2026-67632 fix.
Microsoft also recommends enabling encryption with Extended Protection to help secure SQL Server on Windows. That is general hardening guidance, and nothing in the records shows it prevents this overflow. No CVE-specific configuration workaround has been published.
Verifying the fix
After patching, run the following on each instance and confirm the result is equal to or higher than the fixed build for that instance's branch:
SELECT SERVERPROPERTY('ProductVersion')
Detection Methods
At the time of writing, the only public way to detect CVE-2026-67632 is to find SQL Server builds that are still vulnerable. Nobody has published a way to spot an exploitation attempt or a compromise. We found no CVE-specific Sigma, YARA, Snort or Suricata, or EDR rules, and no IoCs. The GitHub Advisory entry is unreviewed, lists no affected or patched package versions and points to no source code.
1. Inventory every instance and read its build number
Microsoft's guide Find the version and edition of your SQL Server Database Engine provides two queries. The quick one:
SELECT @@VERSION
The one that returns separate fields, better suited for scripts and fleet inventory:
SELECT SERVERPROPERTY('productversion'), SERVERPROPERTY('productlevel'), SERVERPROPERTY('edition')
The same guide covers non-query methods such as SSMS and the error log for instances you cannot log in to. Run the inventory query across all instances, including SQL Server on Linux, and compare each productversion with the fixed builds above. Where a query is not possible, the KB file versions (for example 2022.160.1220.3 for the 2022 GDR) support a file-based check on sqlservr.exe.
2. Compare within the correct servicing branch
This is where version checks commonly fail. A SQL Server 2022 instance at 16.0.4200.x is numerically higher than the GDR fix (16.0.1220.3), but it sits on the CU branch and remains vulnerable until it reaches 16.0.4315.2. Detection logic must first determine the branch from the build range (low build numbers indicate GDR, higher ones indicate CU) and then compare within that branch. A single greater-than comparison on the version string will produce false negatives.
3. Understand how Microsoft Update chooses a package
Each KB notes that Microsoft updated the update detection logic for this and future security releases, documented in Updates to the Microsoft Update detection logic for SQL Server servicing:
- Automatic Updates (Microsoft Update) offers the CU-branch security release only to instances that already have a CU installed. Clean or GDR instances get the GDR package.
- WSUS and the Microsoft Update Catalog use the newer logic, which can apply the CU-branch security release to a clean baseline instance.
- An instance that already has a GDR update must be updated manually, outside Microsoft Update, before WSUS can manage it on the CU branch.
In practice, "WSUS reports compliant" or "no update offered" only tells you which branch the tooling believes the instance is on. Confirm the actual build with the queries above, especially for instances that have switched branches.
4. Commercial scanner coverage
Rapid7's vulnerability database has an entry for CVE-2026-67632 with the same 8.8 vector, so scanners using that content should flag unpatched builds. The public entry does not explain how the check works. Treat it as the same build comparison described above.
5. Exploitation detection gaps
No public network signatures, log patterns or host artifacts tie activity to this CVE. Microsoft does say that exploitation requires a valid, authenticated SQL login and works by sending crafted queries or requests to the engine. Until vendors publish specific content, watch unpatched instances for unexpected engine crashes or memory corruption events, and for activity from unusual or low-privileged logins. These are general signals, not proof of this exploit. Check for Microsoft Defender, Talos or SigmaHQ updates as the CVE matures.
Affected Systems and Versions
NVD's CNA-supplied ranges cover x64 SQL Server on both Windows and Linux. Lower bounds are inclusive, and the fixed build is excluded.
- SQL Server 2017 GDR: 14.0.0 up to, but not including, 14.0.2150.2
- SQL Server 2017 CU31: 14.0.3006.16 up to, but not including, 14.0.3570.2
- SQL Server 2019 GDR: 15.0.0 up to, but not including, 15.0.2210.4
- SQL Server 2019 CU32: 15.0.4003.23 up to, but not including, 15.0.4510.2
- SQL Server 2022 GDR: 16.0.0 up to, but not including, 16.0.1220.3
- SQL Server 2022 CU27: 16.0.4003.1 up to, but not including, 16.0.4315.2
- SQL Server 2025 GDR: 17.0.1050.2 up to, but not including, 17.0.1155.3
- SQL Server 2025 CU10: 17.0.4006.0 up to, but not including, 17.0.5045.3
Exploitation also requires that an attacker can authenticate to the instance with at least a low-privileged login and reach it over the network.
Vendor Security History
SQL Server ranked third in the November 2026 DB Engines popularity ranking, a measure of visibility based on web mentions, search activity, technical discussions, job advertisements and professional profiles rather than market share.
Microsoft's broader record includes the summer 2023 Exchange Online intrusion reviewed by the Cyber Safety Review Board. The Board described how Storm-0558, assessed as affiliated with the People's Republic of China, used tokens signed with a Microsoft key together with an authentication system flaw. It characterized the incident as a cascade of security failures that should not have happened, and criticized delayed correction of inaccurate public information. That case concerns Exchange Online authentication and provides no basis to link Storm-0558 to CVE-2026-67632.
Microsoft's July 2026 Secure Future Initiative report lists these self-reported metrics:
- 99.97% phishing-resistant MFA coverage
- 98.7% credential isolation across boundaries
- 732,000 resources with public access removed
- more than 550,000 critical and high-risk open-source vulnerabilities remediated
- about 3 million container vulnerability instances addressed monthly
- more than 100 new detections
- 1,989 published CVEs with CWE and CPE annotations
These program metrics sit alongside newly disclosed defects such as this one. For response planning, the concrete fixed builds and the documented regression matter more than program-level claims.
References
- NVD: CVE-2026-67632
- CVE Record: CVE-2026-67632
- Microsoft Security Update Guide: CVE-2026-67632
- NVD API record for CVE-2026-67632
- MSRC affected product data
- MSRC vulnerability data
- KB5129300: SQL Server 2022 CU27 security update
- KB5129300 (alternate link)
- KB5129300 servicing article
- KB5129299: SQL Server 2025 CU10 security update
- KB5129299 servicing article
- KB5132747: SQL Server 2022 GDR security update
- KB5132748: SQL Server 2025 GDR security update
- KB5132745: SQL Server 2019 CU32 security update
- KB5132751: SQL Server 2019 GDR security update
- KB5132746: SQL Server 2017 CU31 security update
- KB5132749: SQL Server 2017 GDR security update
- Find the version and edition of your SQL Server Database Engine
- Updates to the Microsoft Update detection logic for SQL Server servicing
- GitHub Advisory GHSA for CVE-2026-67632
- Rapid7 vulnerability database entry
- MITRE CWE-122: Heap-based Buffer Overflow
- Zero Day Initiative: The November 2026 Security Update Review
- Senserva CVE-2026-67632 tracker
- CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
- Microsoft SFI Progress Report July 2026
- DB Engines Ranking
- DB Engines Ranking Method
- What Is SQL Server? (Microsoft Learn)
