CVE-2026-67631 – Microsoft SQL Server Remote Code Execution Vulnerability

CVE-2026-67631 is a critical heap-based buffer overflow vulnerability in Microsoft SQL Server. An authenticated attacker with low privileges can connect to an affected SQL Server over the network and submit a specially crafted query or request that triggers memory corruption, potentially allowing code execution on the server. No user interaction is required.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: Successful exploitation could allow an authenticated attacker to execute code remotely on an affected SQL Server. The vulnerability has low attack complexity and can be reached over the network with low privileges. Successful exploitation could result in high impact to confidentiality, integrity, and availability.

EXPLOITS: This vulnerability is not publicly disclosed and is not reported as exploited. Exploit Code Maturity is listed as Unproven, and the exploitability assessment is Exploitation Less Likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-67631 is caused by a heap-based buffer overflow (CWE-122) in Microsoft SQL Server. An authenticated attacker can connect to an affected SQL Server and send a specially crafted query or request that triggers a memory corruption condition. The attack can be performed over the network with low attack complexity and requires low privileges but no user interaction. Successful exploitation can allow the attacker to execute code on the server, with potentially high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products are Microsoft SQL Server 2017 for x64-based Systems (CU 31 and GDR), SQL Server 2019 (CU 32 and GDR), SQL Server 2022 (CU 26 and GDR), and SQL Server 2025 (CU8 and GDR). Exploitation requires an authenticated attacker with low privileges to submit a specially crafted query or request over the network. No user interaction is required.

BUSINESS IMPACT: Remote code execution on a database server can put sensitive business information and critical database services at risk. Successful exploitation could compromise data confidentiality and integrity or disrupt SQL Server availability. For organizations that depend on SQL Server for important applications and business processes, compromise of a database server could have significant operational consequences.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available, so affected SQL Server installations should be updated where operationally possible.

URGENCY: This vulnerability is rated Critical and can lead to remote code execution over the network with low attack complexity. Although exploitation is assessed as less likely and no active exploitation is reported, affected SQL Server systems should be prioritized for deployment of the official fix because successful exploitation can have high confidentiality, integrity, and availability impact.