Microsoft SQL Server heap-based buffer overflow allows unauthenticated remote code execution (CVE-2026-67631)

What happened

Microsoft has published a critical vulnerability in SQL Server. It is a heap-based buffer overflow that allows an unauthorized attacker to execute code over a network. The CVSS 3.1 score is 9.8, with critical severity. The vector means the attack can be carried out across a network with low complexity, requires no privileges and no user interaction, and has high impact on confidentiality, integrity and availability.

Microsoft's advisory does not record any known exploitation or public disclosure of this vulnerability. No vendor workaround is listed.

Who is affected

SQL Server is a relational database platform. Affected deployments are those running SQL Server 2017, 2019, 2022 or 2025 in either the GDR or CU servicing branch. Microsoft lists these affected version ranges:

• SQL Server 2017 CU 31: 14.0.0 to before 14.0.3550.4
• SQL Server 2017 GDR: 14.0.0 to before 14.0.2130.4
• SQL Server 2019 CU 32: 15.0.0.0 to before 15.0.4490.9
• SQL Server 2019 GDR: 15.0.0 to before 15.0.2190.7
• SQL Server 2022 CU 26: 16.0.0.0 to before 16.0.4275.2
• SQL Server 2022 GDR: 16.0.0 to before 16.0.1200.5
• SQL Server 2025 CU8: 17.0.0.0 to before 17.0.4085.5
• SQL Server 2025 for x64-based Systems GDR: 17.0.1050.2 to before 17.0.1135.8

Check the installed build of each SQL Server instance against these ranges.

What to do now

1. Identify whether your SQL Server is on the CU or GDR servicing branch, then apply the matching fixed build from Microsoft's September 2026 security update:

• SQL Server 2017 CU 31: 14.0.3550.4 (KB5122774)
• SQL Server 2017 GDR: 14.0.2130.4 (KB5122775)
• SQL Server 2019 CU 32: 15.0.4490.9 (KB5122772)
• SQL Server 2019 GDR: 15.0.2190.7 (KB5122773)
• SQL Server 2022 CU 26: 16.0.4275.2 (KB5122768)
• SQL Server 2022 GDR: 16.0.1200.5 (KB5122771)
• SQL Server 2025 CU8: 17.0.4085.5 (KB5122769)
• SQL Server 2025 for x64-based Systems GDR: 17.0.1135.8 (KB5122770) Microsoft's security update guide has the KB details.

1. If you cannot apply the update immediately, restrict network access to SQL Server. Microsoft's advisory does not list a workaround, so patching is the primary mitigation. Ensure SQL Server ports are not reachable from untrusted networks and only application servers and administrators can connect.
2. After updating, verify the installed build matches or exceeds the fixed version for your branch, and rescan for any SQL Server instances that may have been missed.

How to detect it

Microsoft has not published specific indicators of compromise for this CVE. Because the vulnerability requires no credentials or user interaction, prioritise identifying SQL Server instances reachable from untrusted networks or exposed database ports.

Beyond the patch

Beyond patching, a critical, network-reachable service should be treated as part of your exposure surface. Virtual CISO Services (vCISO) can help identify SQL Server instances reachable from the internet or trusted networks and set segmentation priorities; Managed Detection & Response (MDR) can watch for the code execution and privilege abuse that would follow an attempt to exploit this vulnerability.