Organisations urged to patch SQL Server 2017-2022 to stop authenticated remote code execution via heap overflow
Microsoft rates a heap overflow in SQL Server as high severity, noting that authorised attackers can execute code remotely.
Key points
- The flaw is a heap-based buffer overflow in Microsoft SQL Server.
- An authorised attacker can exploit this to run code over a network.
- Versions of SQL Server 2017, 2019 and 2022 are affected.
Microsoft SQL Server contains a high-severity heap-based buffer overflow that allows authorised attackers to execute code remotely. The National Vulnerability Database assigns the issue CVE-2026-94512 with a CVSS score of 8.8. This vulnerability enables remote code execution over a network, provided the attacker holds valid credentials. The weakness is classified under CWE-122.
How it unfolded
- Microsoft published an official security advisory describing the remote code execution vulnerability in SQL Server.
- The National Vulnerability Database recorded the flaw with a high severity rating of 8.8.
- The advisory details that the heap-based buffer overflow permits network-based code execution by authorised users.
Who is affected
Microsoft SQL Server 2017 installations are affected if they are before version 14.0.2140.2 for General Distribution Releases or before 14.0.3560.2 for Cumulative Update 31 on x64 systems. SQL Server 2019 is vulnerable in versions before 15.0.2200.2 (GDR) and before 15.0.4500.2 (CU32 for x64). SQL Server 2022 is at risk in versions before 16.0.1210.3 (GDR) and before 16.0.4305.5 (CU27 for x64).
The fix
Microsoft has released updates to address this high-severity flaw. Administrators should apply the relevant cumulative updates or general distribution releases to ensure their SQL Server instances are patched. Systems running versions prior to the specified build numbers remain exposed to remote code execution by authorised attackers. No further confirmation of additional fixes is provided in the current advisory.
What analysts watch for
Security teams usually monitor for unusual database queries or unexpected process spawns on SQL Server hosts. Analysts check whether authorised accounts are being used to execute commands outside normal operational patterns. They examine heap memory anomalies and look for signs of buffer overflow exploitation. Teams also review network logs for outbound connections from database servers, which often indicate post-exploitation activity.
What to do and how to stay safe: Microsoft SQL Server
- Verify your SQL Server version against the affected builds listed in the advisory.
- Apply the latest cumulative updates or general distribution releases promptly.
- Monitor database logs for unauthorised code execution attempts by valid users.
- Restrict network access to SQL Server instances to minimise exposure.
Step-by-step guide: Patch Management: Eight Questions Answered for Stability
General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-94512?
It is a heap-based buffer overflow in Microsoft SQL Server that allows authorised attackers to execute code remotely.
Which SQL Server versions are affected?
Versions of SQL Server 2017, 2019 and 2022 before specific cumulative updates or general distribution releases are affected.
Is an unauthenticated exploit possible?
No, the advisory states that an authorised attacker is required to exploit this vulnerability over a network.
