CVE-2026-78456

CVE-2026-78456 is a heap-based buffer overflow (CWE-122) in Microsoft SQL Server that is reachable over the network and is triggered when a low-privileged, authenticated attacker sends crafted input to the database service. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms that valid credentials are required but no user interaction or special conditions are needed, so any account with login rights to an affected instance can attempt exploitation. Successful exploitation yields remote code execution in the context of the SQL Server service account, with high impact on confidentiality, integrity and availability, and provides a foothold commonly used for lateral movement into the surrounding Windows and Active Directory environment. Any organization running Microsoft SQL Server is potentially affected; the available data does not enumerate affected versions, editions, or whether Azure SQL offerings are included, so scoping depends on Microsoft's advisory. As of this analysis there is no known public proof of concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only about a 0.9% chance of exploitation within the next 30 days.

What to do: Patch all SQL Server instances according to Microsoft's security advisory (the available data does not list fixed versions or KB numbers), prioritizing internet-exposed servers; in the meantime, restrict network access to SQL Server ports such as TCP 1433 to trusted networks and audit which accounts hold logins on exposed instances. With no public PoC, no KEV listing and modest EPSS (~0.9% in 30 days), there is no evidence of active exploitation yet, but monitor Microsoft's advisory and threat reporting for updates.