Quick Look: SQL Server 2025 CVE-2026-67646, an Authenticated Heap Buffer Overflow Leading to Remote Code Execution

Introduction

A heap buffer overflow in the Microsoft SQL Server 2025 engine lets any authenticated user with low privileges send a crafted query or request that corrupts server memory and can lead to code execution on the database host. Microsoft shipped fixes on November 10, 2026 for both SQL Server 2025 servicing branches. The CU branch package comes with a documented monitoring regression that DBAs should know about before they deploy it.

The vulnerability is tracked as CVE-2026-67646 and classified as CWE-122. The input data lists the vendor as unknown, but the CVE record names Microsoft Corporation as the CNA, and the affected products are Microsoft SQL Server 2025 builds.

Technical information

Root cause

Microsoft describes CVE-2026-67646 as a heap buffer overflow in SQL Server that allows an authorized attacker to execute code over a network. MITRE defines CWE-122 as writing beyond the end of a buffer allocated on the heap. As a class, this weakness can produce crashes or arbitrary code execution, for example through corruption of function pointers. Those are general CWE consequences. Microsoft has not said which specific mechanism applies here.

The MSRC FAQ says only that an authenticated attacker sends a specially crafted query or request that causes memory corruption. SQL Server is closed source, so there is no public commit or diff to inspect, and the KB fix tables do not link internal bug IDs to CVE numbers. Because the November 2026 updates bundle 37 SQL Server CVEs, we cannot say with certainty which fix entry corresponds to this CVE. Several heap overflow fixes in the same packages are plausible candidates, none of them confirmed by Microsoft:

• "Fixes a heap buffer overflow during XML operation" (SQL Server Engine / Programmability, Linux and Windows): bug 5622177 in the GDR; 5270275 and 5622175 in CU10. This fits the advisory's description of a network-reachable query path, but the link is unconfirmed.
• A heap buffer overflow in the Log Reader Agent (Replication): bug 5723121 in the GDR; 5723117 in CU10.
• A buffer overflow when merge replication handles more than 250 WebSync XML nickname entries: bug 5632855 in the GDR; 5632854 and 5632856 in CU10.

The general shape of a CWE-122 fix is to check a length or count against the allocated size of the heap buffer before copying data into it. Other fixes in the same release follow that pattern, such as "bounded validation" in Merge Replication error parsing, and returning an error instead of corrupting memory when JSON paths are too long or too deeply nested. Until Microsoft or a binary diff analysis says more, treat the specific code path for CVE-2026-67646 as undisclosed.

The advisory does not identify the vulnerable function or component, the exact SQL syntax, the named database permission required, the corrupted object layout, an exploit payload, or the operating system security context an attacker would land in. The "crafted query" wording does not mean the underlying bug is SQL injection.

Scoring

Microsoft, as CNA, published the following base vector, which NVD displays without a separate NIST assessment:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

That yields a base score of 8.8 (High). Microsoft's own severity rating is Important, which comes from a different rating system and does not conflict with the score. The advisory also publishes a temporal score of 7.7 with this extended vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

The temporal metrics say exploit code maturity is Unproven, the remediation level is Official Fix, and the report is Confirmed. The network attack vector does not remove the authentication requirement. PR:L means the attacker needs a valid, low-privileged login.

Attack flow

Based on Microsoft's description, the documented sequence is:

1. The attacker obtains low-privileged authenticated access to an affected SQL Server 2025 instance.
2. The attacker connects over the network and submits a specially crafted query or request.
3. Processing that input writes past the end of a heap allocation, corrupting memory in the server process.
4. The corruption can be used to execute code on the server. No interaction from another user is required.

This is the vendor's description of possible exploitation, not a reconstruction of an observed intrusion.

Exploitation status

At publication, Microsoft listed the vulnerability as "Exploited: No", "Publicly disclosed: No", and "Exploitation Unlikely". Senserva reports that it is not in the CISA KEV catalog and has no EPSS score. The finding is credited to the Microsoft Red Team, which is a research acknowledgment rather than attacker attribution. The reviewed sources associate no threat actor, campaign, public exploit, or indicators of compromise with this CVE.

Patch information

Microsoft fixed CVE-2026-67646 on November 10, 2026 as part of Patch Tuesday. The fix ships only as compiled binaries, and MSRC sets the Remediation Level to Official Fix (RL:O), meaning Microsoft treats it as a complete vendor fix rather than a workaround.

Two packages, one per servicing branch

• SQL Server 2025 CU10 + GDR: KB5129299. Fixed build 17.0.5045.3 (file version 2025.170.5045.3). MSRC says to apply it if the current version is 17.0.4006.2 through 17.0.5035.5. It rolls up everything through CU10 (KB5125471).
• SQL Server 2025 RTM + GDR: KB5132748. Fixed build 17.0.1155.3 (file version 2025.170.1155.3). MSRC says to apply it if the current version is 17.0.1000.7 through 17.0.1145.4. It includes the previous GDR (KB5128492).

Both KB articles list CVE-2026-67646 among the issues fixed, and both apply to SQL Server 2025 on Windows and Linux, all editions.

A GDR (General Distribution Release) carries only security and other critical fixes. A CU (Cumulative Update) includes all accumulated fixes for its line. Install the package for the branch you are already on. In practice, a server running a 17.0.4xxx or 17.0.5xxx build takes KB5129299, and a server on a 17.0.1xxx build takes KB5132748. Installing a CU moves an instance onto the CU servicing branch.

Getting and verifying the fix

• Sources: Windows Update / Microsoft Update, the Microsoft Update Catalog (search for the KB number), or the Microsoft Download Center. On Linux, you install KB5129299 by updating the SQL Server packages from a configured CU repository.
• Package hashes (SHA256) for the x64 installers:

KB5129299  64AC66C63E7037F8578B3C2CB76D093E4E11F5D65951EC5545BE92AF44BEA190
KB5132748  CB08B7AB9D18CC6DC16FF519DCFBD4316D0D6275A1B1FAC7EE021BBD9BC69086

• Confirmation: the instance should report product version 17.0.5045.3 (CU branch) or 17.0.1155.3 (GDR branch) or later.

Known issue with KB5129299

On the CU10 branch, querying sys.dm_exec_requests while a database is still recovering can cause an access violation and a dump file. This can happen during a RESTORE, during startup recovery, or while an availability group replica is coming online. Microsoft traces it to a change in this update that uses internal structures before they are fully initialized, and says it is investigating a fix. Until then, Microsoft offers three options:

• Enable trace flag 4696 to turn off that code change. Monitoring queries against sys.dm_exec_requests or sys.sysprocesses on secondary replicas may then return error 976 or 978 again, as they did before the update.
• Avoid querying sys.dm_exec_requests against databases that are recovering.
• Uninstall the update.

Uninstalling also removes the fix for CVE-2026-67646, so the trace flag is the safer option if you hit this problem. These options address the regression only. They are not workarounds for the vulnerability, and Microsoft has published no vulnerability-specific workaround.

Affected systems and versions

The CVE record (as shown on NVD) lists two affected products:

• Microsoft SQL Server 2025 CU10: versions from 17.0.4006.0 up to, but not including, 17.0.5045.3.
• Microsoft SQL Server 2025 for x64 based Systems (GDR): versions from 17.0.1050.2 up to, but not including, 17.0.1155.3.

The MSRC applicability ranges for the updates differ slightly (17.0.4006.2 through 17.0.5035.5 for KB5129299, and 17.0.1000.7 through 17.0.1145.4 for KB5132748). Either way the rule is the same: if your build is lower than the fixed build for your branch, treat the instance as vulnerable. Both branches cover Windows and Linux, all editions.

The MSRC FAQ table also lists November GDR packages for SQL Server 2022, 2019 and 2017. The advisory's own Security Updates table, however, names only the two SQL Server 2025 products for this CVE, so do not read those other packages as fixes for CVE-2026-67646 specifically.

Vendor security history

SQL Server is Microsoft's flagship database management system, first released in 1989 for OS/2. Independent reporting places it third in DB Engines popularity, behind Oracle and MySQL. That reach is why SQL Server memory-safety bugs get attention.

The best-known precedent is the January 2003 SQL Slammer worm, which targeted SQL Server 2000 and MSDE 2000 and caused a dramatic spike in worldwide network traffic. Microsoft stated that the exploited vulnerability had first been patched in July 2002 (bulletin MS02-039), with cumulative updates following, including one in October 2002. Microsoft responded with an easier installer, extra support staff and free support calls. Slammer showed the gap between a patch existing and deployments being protected. There is no evidence linking Slammer-era exploitation to CVE-2026-67646. The comparison is only about patch adoption.

For this CVE, the finding is credited to Microsoft's own Red Team, and the fix is distributed through SQL Server's regular servicing channels.

References

• NVD entry for CVE-2026-67646
• CVE Record for CVE-2026-67646
• Microsoft Security Update Guide: CVE-2026-67646
• KB5129299: Security update for SQL Server 2025 CU10, November 10, 2026
• KB5132748: Microsoft Support
• KB5132748: Security update for SQL Server 2025 GDR, November 10, 2026
• Microsoft Learn: Updates to the Microsoft Update detection logic for SQL Server
• MITRE CWE-122: Heap based Buffer Overflow
• Senserva: CVE-2026-67646
• Senserva: KB5129299 known issues
• Senserva: KB5132748
• CISA Known Exploited Vulnerabilities Catalog
• Microsoft statement on the Slammer worm attack (2003)
• Microsoft Security Bulletin MS02-039
• Gartner Magic Quadrant for Cloud Database Management Systems
• Simple Talk: Top database platforms in 2026
• The Register: SQL Server may be too lucrative for Microsoft to ditch