CVE-2026-67388

CVE-2026-67388 is a heap-based buffer overflow (CWE-122) in Microsoft SQL Server, rated 8.8 High under CVSS 3.1. An authorized attacker holding low-privilege credentials can send crafted requests over the network that overflow heap memory; the attack is of low complexity and requires no user interaction. Successful exploitation yields remote code execution in the context of the SQL Server service, exposing highly sensitive database contents and potentially opening a path to the underlying host. Any organization running an affected SQL Server version is exposed wherever an attacker can obtain or already holds a low-privilege login, including application service accounts and internet-reachable instances. As of this analysis there is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.5% probability of exploitation within 30 days.

What to do: Track Microsoft's advisory for CVE-2026-67388 and deploy the SQL Server security update it identifies to every instance, including SQL Server Express and LocalDB copies bundled inside third-party and Microsoft applications. Until patched, avoid exposing SQL Server (port 1433) directly to the internet, restrict network reachability to trusted hosts, and audit which accounts hold SQL logins so low-privilege credentials are tightly scoped. Note that no affected version numbers were included in the data analyzed here, so verify applicability of specific installations against Microsoft's advisory.