CVE-2026-47297 – Microsoft SQL Server 2019 (CU 32)
“Your database holds the crown jewels; four remote code execution paths into SQL Server leave the vault door wide open.”
This Microsoft SQL Server 2019 (CU 32) update fixes five vulnerabilities, including two Critical and three High severity flaws. Four of them allow remote code execution. The flaws include unsafe deserialization of untrusted data, an untrusted pointer dereference, a stack-based buffer overflow, and an out-of-bounds read. Together they expose the database engine that business-critical applications depend on.
CVE-2026-67378 has a CVSS score of 9.0, Critical severity. CVE-2026-67636 has a CVSS score of 9.0, Critical severity, and enables remote code execution through an out-of-bounds read. CVE-2026-77484 has a CVSS score of 8.8, High severity, and CVE-2026-47297 has a CVSS score of 8.1, High severity; both enable remote code execution through unsafe deserialization. CVE-2026-67379 has a CVSS score of 8.5, High severity, and enables remote code execution through a stack-based buffer overflow. Apply this update to every SQL Server 2019 instance on a same-day timeline.
Key Details
- Affected Product
- Microsoft Sql Server 2019
- Attack Vector
- Network
- Attack Complexity
- High
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-502