Businesses Using SQL Server 2017-2022 Face Remote Code Execution Risks From High-Severity Heap Overflow Vulnerability
A high-severity flaw in Microsoft SQL Server versions 2017 through 2022 allows authorized users to run code remotely, posing operational risks to businesses relying on these databases.
Key points
- CVE-2026-67625 is a heap-based buffer overflow rated high severity with a CVSS score of 8.5.
- The vulnerability affects Microsoft SQL Server 2017, 2019, and 2022 builds prior to specific cumulative updates.
- An attacker must already have authorization to exploit the flaw and execute code over the network.
Organisations running Microsoft SQL Server face a new remote code execution risk due to a heap-based buffer overflow identified as CVE-2026-67625. According to the National Vulnerability Database, this flaw carries a high severity rating of 8.5. The vulnerability allows an attacker who already possesses authorisation to execute arbitrary code over a network connection. This issue impacts Microsoft SQL Server 2017, 2019, and 2022, as listed in the official advisory and NVD record.
The risk
The core issue is a heap-based buffer overflow, classified under CWE-122 by the National Vulnerability Database. Microsoft’s security update guide confirms that this flaw enables remote code execution. Crucially, the source material specifies that the attacker must be authorised to trigger the exploit. This means the vulnerability does not allow unauthenticated remote access from the internet. Instead, it allows an authorized attacker to execute code over a network, as stated in the advisory.
Who is exposed
Microsoft SQL Server 2017, 2019, and 2022 are affected, but only specific builds remain vulnerable. According to the NVD record, SQL Server 2017 General Distribution Release builds before 14.0.2140.2 are exposed. SQL Server 2017 Cumulative Update 31 builds before 14.0.3560.2 are also affected. For SQL Server 2019, General Distribution Release builds before 15.0.2200.2 and Cumulative Update 32 builds before 15.0.4500.2 are at risk. SQL Server 2022 builds before 16.0.1210.3 (GDR) and 16.0.4305.5 (CU27) are similarly exposed.
Cost and compliance
The source material does not provide specific data on financial losses, regulatory fines, or compliance implications associated with CVE-2026-67625. No details regarding industry-specific mandates or breach notification requirements are included in the Microsoft advisory or the NVD record. Organisations should review their own internal risk frameworks to determine if this vulnerability triggers any specific audit requirements or insurance clauses related to software maintenance and patch management.
What happens next
Managers should verify the exact build numbers of their SQL Server installations against the affected versions listed by the National Vulnerability Database. Teams need to confirm whether their current users have the necessary authorisation levels that could be exploited. Since the flaw requires authorisation, reviewing user access controls is a critical immediate step while preparing for the necessary software updates provided by Microsoft.
Questions to ask your suppliers
Teams should ask vendors whether their hosted applications rely on the affected SQL Server versions. Check if suppliers have a process for verifying database patch levels in their environments. Determine who within your organisation is responsible for validating that third-party services are not using vulnerable builds. Ensure that your procurement team includes software maintenance status in their regular vendor risk assessments. This helps identify external dependencies that might remain exposed while you manage your own internal systems.
Background: National Vulnerability Database
The National Vulnerability Database is a centralized repository that standardizes information about software weaknesses. It assigns unique identifiers to each flaw, allowing security tools to automatically detect and assess risks in your systems without manual research.
Read the full guide: National Vulnerability Database Explained: How NVD Works for You
What to do and how to stay safe: Microsoft SQL Server
- Audit your SQL Server installations to identify if they match the specific vulnerable build numbers listed in the NVD record.
- Review user access controls to ensure only necessary personnel have authorisation to interact with the database, reducing the attack surface.
- Monitor Microsoft’s security update guide for the official patch release and test it in a non-production environment before deployment.
- Once the vendor provides an update, apply it to all affected SQL Server 2017, 2019, and 2022 instances promptly.
Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business
General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does CVE-2026-67625 allow anyone on the internet to hack my SQL Server?
No, the source material states that an attacker must already be authorised to execute code over the network.
Which SQL Server versions are affected by this heap overflow?
Microsoft SQL Server 2017, 2019, and 2022 are affected, specifically builds prior to the update versions listed in the NVD record.
What is the severity rating of this vulnerability?
The National Vulnerability Database rates CVE-2026-67625 as high severity with a CVSS score of 8.5.
