CVE-2026-67642

CVE-2026-67642 is a heap-based buffer overflow (CWE-122) in Microsoft SQL Server that can be triggered remotely over the network by an authorized attacker. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates that an attacker who already holds valid, low-privileged credentials can send crafted input to the database service and corrupt heap memory without any user interaction. Successful exploitation yields remote code execution in the context of the SQL Server process, with high impact on confidentiality, integrity, and availability of the host. All Microsoft SQL Server deployments are potentially in scope, though the available data does not enumerate specific affected versions or editions. There is currently no evidence of exploitation: the flaw is not in CISA's KEV, no public proof-of-concept is known, and EPSS estimates only a ~0.5% probability of exploitation within 30 days (41st percentile).

What to do: Apply Microsoft's security update for SQL Server as soon as it is published via Windows Update/WSUS or the Microsoft Update Catalog, prioritizing instances reachable from untrusted networks. Until patched, reduce exposure by firewalling TCP 1433, restricting remote database access to trusted, low-privilege accounts, and auditing which credentials can connect to internet-facing instances. Monitor Microsoft's advisory for the definitive list of affected versions and builds, since these are not yet enumerated in the available data.