Information Disclosure in Windows OLE DB by Microsoft
CVE-2026-78441

6.5MEDIUM

Key Information:

Vendor

Microsoft
Status
Microsoft Sql Server 2017 (cu 31)
Microsoft Sql Server 2017 (gdr)
Microsoft Sql Server 2019 (cu 32)
Microsoft Sql Server 2019 (gdr)
Vendor
CVE Published:
8 September 2026

What is CVE-2026-78441?

An out-of-bounds read vulnerability in Windows OLE DB permits unauthorized attackers to access sensitive information over a network, potentially allowing data leakage. This issue could have serious implications for data integrity and user privacy, highlighting the importance of applying security updates and patches to mitigate risks.

Affected Version(s)

Microsoft SQL Server 2017 (CU 31) x64-based Systems 14.0.0 < 14.0.3550.4

Microsoft SQL Server 2017 (GDR) x64-based Systems 14.0.0 < 14.0.2130.4

Microsoft SQL Server 2019 (CU 32) x64-based Systems 15.0.0.0 < 15.0.4490.9

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.