CVE-2026-77481

CVE-2026-77481 is a heap-based buffer overflow (CWE-122) in Microsoft SQL Server. An attacker who already holds low-privileged credentials can trigger it by sending crafted requests to the SQL Server instance over the network; the overflow occurs in server-side heap memory during processing of such requests. Successful exploitation yields remote code execution, with CVSS 3.1 scoring high impact on confidentiality, integrity, and availability (8.8, AV:N/PR:L). All organizations running affected SQL Server builds are in scope; the data available here does not specify which versions or service branches are affected, so defenders must consult Microsoft's advisory for the affected-builds table. Exploitation status is currently quiet: EPSS puts 30-day exploitation probability at just 0.6% (48th percentile), the flaw is not in CISA's KEV catalog, and no public proof-of-concept is known.

What to do: Identify all SQL Server instances in the estate and map their builds against the affected-versions table in Microsoft's advisory, then apply the corresponding SQL Server security update once patched builds are published. Because exploitation requires only low-privileged authenticated access, restrict network reachability of SQL Server ports (e.g., TCP/1433) to trusted networks, enforce least privilege on SQL logins, and review which accounts hold connect rights. Until patching, monitor for anomalous memory/resource behavior in SQL Server processes and watch Microsoft's advisory and KEV feeds for updates on affected builds or observed exploitation.