Microsoft SQL Server heap-based buffer overflow lets unauthenticated attackers execute code over a network (CVE-2026-67643)

What happened

A heap-based buffer overflow (CWE-122) in Microsoft SQL Server can be triggered over a network by an unauthenticated attacker. The vulnerability is rated critical with a CVSS 3.1 base score of 9.8; the vector describes an attack that needs no privileges, requires no user interaction, and can achieve high impact on confidentiality, integrity and availability. Microsoft has not stated that this vulnerability is under active exploitation, the CVE is not listed in CISA's Known Exploited Vulnerabilities catalogue, and no public disclosure is recorded.

Who is affected

This affects Microsoft SQL Server 2022 and Microsoft SQL Server 2025 in both the CU and GDR update branches. Affected builds are: SQL Server 2022 CU from 16.0.0.0 to before 16.0.4275.2; SQL Server 2022 GDR from 16.0.0 to before 16.0.1200.5; SQL Server 2025 CU from 17.0.0.0 to before 17.0.4085.5; and SQL Server 2025 for x64-based Systems GDR from 17.0.1050.2 to before 17.0.1135.8. Check your build number and branch against the fixed builds below.

What to do now

1. Determine which branch and build of SQL Server 2022 or 2025 you are running.
2. Apply the matching fixed build from Microsoft's September 2026 security release:

• SQL Server 2022 CU: 16.0.4275.2 — KB5122768
• SQL Server 2022 GDR: 16.0.1200.5 — KB5122771
• SQL Server 2025 CU: 17.0.4085.5 — KB5122769
• SQL Server 2025 for x64-based Systems GDR: 17.0.1135.8 — KB5122770

1. Microsoft has not provided a workaround for this vulnerability. Until the patch is applied, restrict network access to SQL Server so that it is reachable only from trusted application and management hosts.
2. After applying the update, verify that the reported version matches the relevant fixed build.

How to detect it

Microsoft has not published indicators of compromise for CVE-2026-67643. Because the vulnerability is reachable over a network without credentials, start by identifying SQL Server instances that accept connections from untrusted or internet-exposed segments and confirm that every such path is expected and controlled.

Beyond the patch

The risk here is as much about where SQL Server is reachable as it is about the code flaw. Our vCISO services can map exposed database services and guide the patch across servicing branches; Managed Detection and Response watches the estate for the post-exploitation activity that follows code execution on a database host. That combination turns this bulletin into an inventory and detection exercise rather than a one-off fire drill.