SQL Server Heap-based Buffer Overflow Vulnerability in Microsoft Products
CVE-2026-85886

8.5HIGH

Key Information:

Vendor

Microsoft
Status
Microsoft Sql Server 2017 (gdr)
Microsoft Sql Server 2017 For X64-based Systems (cu31)
Microsoft Sql Server 2019 (gdr)
Microsoft Sql Server 2019 For X64-based Systems (cu32)
Vendor
CVE Published:
13 October 2026

What is CVE-2026-85886?

A heap-based buffer overflow vulnerability in Microsoft SQL Server enables an authorized attacker to execute arbitrary code over a network. This flaw could be exploited to compromise the integrity and confidentiality of data within affected SQL Server environments. It is essential for users to apply the necessary patches to mitigate the risk and protect against potential threats.

Affected Version(s)

Microsoft SQL Server 2017 (GDR) x64-based Systems 14.0.0 < 14.0.2140.2

Microsoft SQL Server 2017 for x64-based Systems (CU31) x64-based Systems 14.0.3006.16 < 14.0.3560.2

Microsoft SQL Server 2019 (GDR) x64-based Systems 15.0.0 < 15.0.2200.2

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.