Brief Summary: SQL Server CVE-2026-94511 Heap-Based Buffer Overflow Allowing Authorized Remote Code Execution

Introduction

Microsoft's November 10, 2026 SQL Server security release fixes a heap-based buffer overflow that lets an authorized attacker run code on the database server over the network, with no user interaction. The fix spans eight servicing branches across SQL Server 2017, 2019, 2022, and 2025 on both Windows and Linux, so most organizations running a supported SQL Server build will need to map at least one instance to a new fixed build.

Technical information

Root cause

Microsoft classifies CVE-2026-94511 as CWE-122: Heap based Buffer Overflow. MITRE describes this class as writing data beyond the end of a buffer allocated on the heap. Microsoft's advisory summary is short: the overflow "allows an authorized attacker to execute code over a network."

That is close to all the public root-cause detail there is. SQL Server is closed source, so there is no public commit or diff, and Microsoft has not named the vulnerable component or code path. The November KB fix tables do contain several heap overflow fixes that look like plausible candidates:

• "Fixes a heap buffer overflow during XML operation" (SQL Server Engine / Programmability)
• A heap buffer overflow fix in the Log Reader Agent

Both appear in the 2025, 2022, and 2017 packages. Microsoft has not confirmed that either one corresponds to CVE-2026-94511, so we do not treat them as the definitive root-cause fix.

Scoring

Microsoft, acting as CNA, assigns the following CVSS 3.1 base vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector: Network (the flaw is reachable remotely)
• Attack Complexity: Low
• Privileges Required: Low (the attacker must already be authorized)
• User Interaction: None
• Scope: Unchanged
• Confidentiality, Integrity, Availability: High

The base score is 8.8 (High), and Microsoft's own severity rating is Important. The MSRC page also shows a temporal score of 7.7, reflecting unproven exploit maturity, an official fix, and a confirmed report. At the time of research NVD had not supplied its own assessment, so 8.8 is Microsoft's CNA score rather than an NVD-assigned one.

Attack flow

The published material supports only a high-level attack path:

1. The attacker holds low-privilege authorization on the target SQL Server.
2. The attacker has network reachability to an instance running an affected build.
3. The attacker sends a specially crafted request to the server.
4. The request triggers the heap overflow, potentially resulting in code execution on the server. No user interaction is required.

The sources do not describe the request format, the payload, authentication specifics beyond the low-privilege requirement, or the affected subsystem, and we do not speculate past that. Read practically, the vector puts the attack surface at any network-reachable instance where an attacker can obtain low-privileged access. Anonymous access is not part of the published vector.

Exploitation status

Microsoft's advisory lists the vulnerability as not publicly disclosed, not exploited, and exploitation unlikely at publication. We found no named threat actor, campaign, public exploit code, or CVE-specific incident report in the reviewed sources. This assessment is time-bounded and can change.

Patch information

Microsoft fixed CVE-2026-94511 in its November 10, 2026 (Patch Tuesday) SQL Server security updates. MSRC lists the remediation level as Official Fix. The fix ships inside the database engine binaries. Once it is installed, the product version moves to a new fixed build. No configuration change is required for this CVE, and the reviewed Microsoft material does not document a CVE-specific workaround.

Choosing the right package: GDR vs. CU

SQL Server has two servicing branches, and installing the wrong package for your branch is a common mistake:

• GDR (General Distribution Release): security and critical fixes only, for servers that stay on the RTM/GDR baseline.
• CU plus GDR: the security fix built on top of the latest Cumulative Update, for servers that already follow the CU train.

Check the current build first:

SELECT SERVERPROPERTY('ProductVersion')

Then find the row whose range contains that build:

Each package is cumulative within its branch. MSRC notes that each one also includes earlier servicing releases, such as the October 2026 GDRs (for example, KB5128492 for SQL Server 2025 RTM). The KB pages state that the updates apply to both Windows and Linux installs.

Obtaining the update

On Windows, the KB articles list three channels: Windows Update / Microsoft Update, the Microsoft Update Catalog (standalone package), or the Microsoft Download Center. For example, the SQL Server 2025 CU10 GDR package is published with this file name and SHA256:

SQLServer2025-KB5129299-x64.exe
64AC66C63E7037F8578B3C2CB76D093E4E11F5D65951EC5545BE92AF44BEA190

On Linux, update the SQL Server packages from the configured CU repository.

Verifying the fix

After installation, the reported product version should match the fixed build for your branch. The KB5129299 page, for example, lists product version 17.0.5045.3 and file version 2025.170.5045.3 for SQL Server 2025 CU10. Any build lower than the fixed build for its branch remains vulnerable.

Known regression

The 2025 CU10 and 2022 CU27 security updates carry a known issue. Querying sys.dm_exec_requests while a database is still recovering (during a RESTORE, startup recovery, or an availability group replica coming online) can cause an access violation and a dump file. Microsoft attributes this to internal in-memory structures being referenced before they are fully initialized. Until a fix ships, Microsoft suggests enabling trace flag 4696 to opt out of that specific code change, or avoiding those queries during recovery. Plan for this when rolling the patch out to heavily monitored or availability group environments.

The same November packages also address many other SQL Server CVEs (more than 30 are listed in KB5129299), so installing the correct package covers CVE-2026-94511 along with all of them.

Affected systems and versions

Microsoft lists the following affected version ranges. The advisory does not state whether range endpoints are inclusive, so compare your exact build against the advisory rather than inferring endpoint behavior.

• SQL Server 2025 CU10 plus GDR branch: 17.0.4006.2 through 17.0.5035.5 (fixed in 17.0.5045.3)
• SQL Server 2025 RTM plus GDR branch: 17.0.1000.7 through 17.0.1145.4 (fixed in 17.0.1155.3)
• SQL Server 2022 CU27 plus GDR branch: 16.0.4003.1 through 16.0.4305.5 (fixed in 16.0.4315.2)
• SQL Server 2022 RTM plus GDR branch: 16.0.1000.6 through 16.0.1210.3 (fixed in 16.0.1220.3)
• SQL Server 2019 CU32 plus GDR branch: 15.0.4003.23 through 15.0.4500.2 (fixed in 15.0.4510.2)
• SQL Server 2019 RTM plus GDR branch: 15.0.2000.5 through 15.0.2200.2 (fixed in 15.0.2210.4)
• SQL Server 2017 CU31 plus GDR branch: 14.0.3006.16 through 14.0.3560.2 (fixed in 14.0.3570.2)
• SQL Server 2017 RTM plus GDR branch: 14.0.1000.169 through 14.0.2140.2 (fixed in 14.0.2150.2)

SQL Server can run on Windows, on Linux, in a Linux container, or on Azure and other virtual machines, and the updates apply to both Windows and Linux installs. Exploitation requires network reachability and low-privileged authorization on the instance.

Vendor security history

DB-Engines ranks Microsoft SQL Server third overall and third among relational database systems (score 693.53). That ranking is a popularity index rather than a market-share figure.

The most prominent independent review of Microsoft's security practices is the Cyber Safety Review Board report on the separate summer 2023 Exchange Online intrusion, which it attributed to Storm-0558, assessed as affiliated with the People's Republic of China. The Board concluded the incident was preventable and that Microsoft's security culture was inadequate, citing decisions that deprioritized security investment and risk management.

Microsoft's July 2026 Secure Future Initiative progress report describes ongoing company-wide remediation. In it, Microsoft self-reports phishing-resistant MFA coverage of 99.97 percent of users and devices, remediation of more than 550,000 critical and high-risk open-source vulnerability instances, and automated container patching of about 3 million vulnerability instances per month.

None of this history concerns SQL Server specifically or CVE-2026-94511, and we do not draw conclusions about this flaw from it.

References

• NVD: CVE-2026-94511
• CVE Record: CVE-2026-94511
• Microsoft Security Update Guide: CVE-2026-94511
• KB5129299: Security update for SQL Server 2025 CU10 (November 10, 2026)
• KB5129300: Security update for SQL Server 2022 CU27 (November 10, 2026)
• KB5132749: Security update for SQL Server 2017 GDR (November 2026)
• MITRE CWE-122: Heap based Buffer Overflow
• Microsoft Learn: What Is SQL Server?
• DB-Engines: Microsoft SQL Server System Properties
• CSRB: Review of the Summer 2023 Microsoft Exchange Online Intrusion
• DHS: CSRB Releases Report on Microsoft Online Exchange Incident
• Microsoft: SFI Progress Report July 2026
• Microsoft: Secure Future Initiative CSRB Mappings
• Microsoft On the Issues: Work to strengthen cybersecurity protection
• CISA Known Exploited Vulnerabilities Catalog
• Rapid7: Patch Tuesday, November 2026
• Senserva: CVE-2026-94511
• Simple Talk: Top Database Platforms in 2026