CVE-2026-67381

Microsoft SQL Server contains a heap-based buffer overflow (CWE-122) that is reachable over the network. An attacker who already holds a valid low-privileged login can send crafted requests that overflow a heap buffer, with low attack complexity and no user interaction required. Successful exploitation elevates the attacker's privileges on the affected SQL Server instance, with the CVSS vector indicating potentially high impact to confidentiality, integrity, and availability. Any organization running the affected SQL Server versions — especially instances that accept network logins from users, applications, or partners — is potentially affected, though the available data does not specify exact version ranges. As of this analysis there is no public proof-of-concept, the flaw is not listed in CISA's KEV, and EPSS assigns a 0.5% probability of exploitation in the next 30 days (41st percentile), so no confirmed in-the-wild exploitation is known.

What to do: Consult Microsoft's advisory for this CVE to identify the affected SQL Server versions and apply the released security update, which is the primary fix. Until patched, limit the network reachability of SQL Server (restrict TCP 1433 to trusted hosts and avoid direct internet exposure) and review which low-privileged accounts can log in remotely, since exploitation requires valid credentials. Monitor the Microsoft Security Response Center and your threat-intel feeds for any published PoC or signs of in-the-wild exploitation.