CVE-2026-67378 – Microsoft SQL Server Remote Code Execution Vulnerability

CVE-2026-67378 is a critical remote code execution vulnerability caused by an untrusted pointer dereference in Microsoft SQL Server. An authenticated attacker with low privileges could connect to an affected SQL Server and submit a specially crafted query or request that triggers memory corruption and allows code execution. Successful exploitation requires specific conditions because attack complexity is high, but no user interaction is required.

CVSS SCORE: 8.5.

SEVERITY: Critical.

THREAT: An attacker with authenticated, low-privilege access could remotely target an affected SQL Server. Successful exploitation could compromise confidentiality, integrity, and availability at a high level. Attack complexity is high because particular protocol settings, configurations, or other specific conditions must exist before exploitation can succeed.

EXPLOITS: This vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: The vulnerability results from an untrusted pointer dereference in SQL Server. An authenticated attacker can connect over the network and send a specially crafted query or request that triggers a memory corruption condition. If the required conditions are present, this can allow the attacker to execute code on the server. The CVSS metrics indicate network-based attack access, high attack complexity, low privileges required, no user interaction, and changed scope. A successful attack can have high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products are Microsoft SQL Server 2019 for x64-based Systems (CU 32 and GDR), Microsoft SQL Server 2022 for x64-based Systems (CU 26 and GDR), Microsoft SQL Server 2025 for x64-based Systems (CU8 and GDR), and Microsoft SQL Server Integration Services. Exploitation requires authenticated access, low privileges, specific conditions, and a specially crafted query or request. No user interaction is required.

BUSINESS IMPACT: Successful exploitation could allow remote code execution on a database server, creating a serious risk to sensitive business information and service availability. With high potential impact to confidentiality, integrity, and availability, compromise could result in unauthorized access to information, modification of data or systems, and disruption of database-dependent business services.

WORKAROUND: No mitigations or workarounds are identified. An official fix is identified as the remediation.

URGENCY: This vulnerability is rated Critical and can lead to remote code execution with high confidentiality, integrity, and availability impact. Although exploitation is considered less likely and requires specific conditions, affected SQL Server environments should prioritize the official fix because successful exploitation could compromise a critical database server.