CVE-2026-67379

CVE-2026-67379 is a stack-based buffer overflow (CWE-121) in Microsoft SQL Server, disclosed by Microsoft's own vulnerability coordination (CNA: [email protected]). A remote attacker who already holds valid low-privileged credentials ('authorized attacker') can trigger the overflow by sending crafted network traffic to a vulnerable SQL Server instance; the precise request path is not detailed in the available data, and the CVSS high-attack-complexity rating indicates exploitation depends on conditions that are harder to arrange reliably. Successful exploitation yields arbitrary code execution with high confidentiality, integrity and availability impact, and the 'scope changed' metric suggests impact may extend beyond the vulnerable component, such as into the service or host context. Any organization running Microsoft SQL Server is potentially affected, though the specific affected version ranges are not enumerated in the available data. Exploitation has not been observed: the flaw is not in CISA's KEV, no public proof-of-concept is known, and EPSS assigns only a ~0.6% probability of exploitation in the next 30 days (48th percentile).

What to do: Apply the Microsoft security update for your SQL Server version (via the monthly Patch Tuesday cumulative updates) as soon as it is available, and check your exact SQL Server build against Microsoft's advisory once it enumerates affected version ranges. Until patched, restrict inbound network access to SQL Server (e.g., TCP 1433) to trusted hosts only, minimize and audit low-privileged SQL logins exposed over the network since the attack requires valid credentials, and monitor for anomalous query activity. Prioritize internet-facing and multi-tenant instances, as they combine network reachability with a broader pool of potentially exposed accounts.