CVE-2026-67643 – Microsoft SQL Server Remote Code Execution Vulnerability

CVE-2026-67643 is a Critical heap-based buffer overflow vulnerability affecting Microsoft SQL Server 2022 and SQL Server 2025. An authenticated attacker with low privileges can connect to an affected SQL Server and submit a specially crafted query or request that triggers memory corruption and allows code execution on the server. The vulnerability can be attacked over the network with low complexity and requires no user interaction.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: Successful exploitation could allow an authenticated attacker to execute code remotely on an affected SQL Server. The CVSS assessment identifies high potential impact to confidentiality, integrity, and availability. Exploitation requires low privileges but no user interaction.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is classified as Unproven, and the exploitation assessment is Exploitation Unlikely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: CVE-2026-67643 is a heap-based buffer overflow (CWE-122) in Microsoft SQL Server. An authenticated attacker can connect over the network and send a specially crafted query or request that causes a memory corruption condition. Successful exploitation can result in remote code execution on the SQL Server. Attack complexity is low, low privileges are required, and no user interaction is necessary. The scope is unchanged, while potential confidentiality, integrity, and availability impacts are all rated High.

EXPLOITABILITY: Affected products are Microsoft SQL Server 2022 for x64-based Systems (CU 26 and GDR) and Microsoft SQL Server 2025 for x64-based Systems (CU8 and GDR). Exploitation requires an authenticated attacker with low privileges to send a specially crafted query or request over the network.

BUSINESS IMPACT: Successful remote code execution on a database server could expose sensitive information, enable unauthorized modification of data, or disrupt database availability. For organizations that depend on SQL Server for business-critical applications, exploitation could affect both data security and operational continuity.

WORKAROUND: No mitigations or workarounds are identified. An official fix is identified as the remediation, and the listed updates require a restart.

URGENCY: This vulnerability is rated Critical and carries a CVSS base score of 8.8. Although exploitation is assessed as unlikely and no exploitation is reported, the combination of network accessibility, low attack complexity, low privilege requirements, no required user interaction, and potential remote code execution makes timely deployment important.