CVE-2026-68787

CVE-2026-68787 is a heap-based buffer overflow (CWE-122) in Microsoft SQL Server that is triggered when the database engine mishandles input from an authorized attacker, overflowing a heap buffer during processing. The attack vector is local (AV:L) with low privileges required, so exploitation needs valid access to the system — such as a low-privileged user or SQL login — rather than an unauthenticated network connection. A successful exploit lets the attacker execute arbitrary code in the context of the SQL Server process, with high impact on confidentiality, integrity, and availability, effectively amounting to local privilege escalation on the database host. Any organization running Microsoft SQL Server is potentially affected, though the available data does not specify which version ranges are vulnerable. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS estimates only a 0.2% probability of exploitation in the next 30 days.

What to do: Check the Microsoft Security Response Center advisory for CVE-2026-68787 to identify the affected SQL Server versions and apply the corresponding security update as soon as it is released. Until patched, restrict local and remote logon rights on SQL Server hosts and limit SQL logins to required accounts, since exploitation requires pre-existing authorized access. Given the low EPSS score and absence of known exploitation, treat this as routine patching priority rather than an emergency.