CVE-2026-67376

CVE-2026-67376 is an integer overflow/wraparound flaw (CWE-190) in Microsoft SQL Server, rated High severity (CVSS 3.1: 7.5). Because the attack vector is network-based with low complexity, no privileges required, and no user interaction, an unauthenticated remote attacker can trigger the overflow by sending crafted network input to a vulnerable SQL Server instance. The flaw only affects availability: it can crash or hang the database service, causing a denial of service, with no confidentiality or integrity impact. Any organization running an affected SQL Server version is exposed, although the specific affected version ranges are not included in the available data and should be confirmed against Microsoft's advisory. There is currently no known exploitation: the flaw is not in CISA's KEV catalog, no public proof-of-concept is known, and EPSS estimates a 0.8% probability of exploitation in the next 30 days (56th percentile).

What to do: Monitor Microsoft's MSRC advisory for the affected version list and apply the corresponding SQL Server security update as soon as it is available, prioritizing instances reachable from untrusted networks. Until patched, restrict inbound access to SQL Server (typically TCP 1433) to trusted clients via firewall/NSG rules and watch for unexpected service crashes or restarts. Given no known PoC or in-the-wild exploitation, standard patch cadence is defensible for internal, non-exposed instances.