{"id":"CVE-2026-116933","kind":"vulnerability","aliases":["CVE-2026-116933"],"related":[],"title":"Microsoft SQL Server: heap overflow lets an authorized user run code","description":"Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.","summary":"Heap-based buffer overflow (CWE-122) in SQL Server lets an authenticated attacker with high privileges (CVSS 7.2, PR:H) run code over the network. It affects self-managed SQL Server 2022 and 2025 instances on builds older than the Nov 10, 2026 updates; the risk is mostly a compromised admin-level login. Managed database services where the provider patches the engine can likely skip it. No exploitation or public PoC found.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SQL Server 2022","fixed":["16.0.1220.3","16.0.4315.2"],"affected":">= 16.0.0, < 16.0.1220.3 (GDR); >= 16.0.4003.1, < 16.0.4315.2 (CU27)","ecosystem":"vendor"},{"name":"SQL Server 2025","fixed":["17.0.1155.3","17.0.5015.4","17.0.5045.3"],"affected":">= 17.0.1050.2, < 17.0.1155.3 (GDR); >= 17.0.4006.2, < 17.0.5015.4 (CU9); >= 17.0.4006.0, < 17.0.5045.3 (CU10)","ecosystem":"vendor"}],"ecosystems":[],"tags":["linux","other","self-hosted","sql-server","windows"],"not_affected_if":["managed-hosting"],"how_to_check":"Run SELECT @@VERSION (or SERVERPROPERTY('ProductVersion')) on each instance and compare with the fixed builds: 2022 GDR 16.0.1220.3; 2022 CU27 16.0.4315.2; 2025 GDR 17.0.1155.3; 2025 CU9 17.0.5015.4; 2025 CU10 17.0.5045.3. Confirm against the MSRC page for your branch.","fix":"Install the November 10, 2026 SQL Server security update for your branch: 2022 GDR 16.0.1220.3, 2022 CU27 16.0.4315.2 (KB5129300), 2025 GDR 17.0.1155.3, 2025 CU9 17.0.5015.4, 2025 CU10 17.0.5045.3.","status":"open","published_at":"2026-11-10T19:19:24+00:00","first_seen_at":"2026-11-10T19:24:46+00:00","triaged_at":"2026-11-10T19:47:53+00:00","updated_at":"2026-11-10T23:35:33+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T19:47:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft SQL Server: heap overflow lets an authorized user run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft SQL Server lets an attacker who already has authorized access run code over the network. The sources give no further detail on the affected versions or trigger.","audience":"businesses","category":"other","nicknames":[],"who_cares":["sql-server","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"code runs on the database server under the attacker's control","analyst_note":"Find the Microsoft advisory for CVE-2026-116933 to confirm affected SQL Server versions, patched builds and any non-default feature required.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Microsoft SQL Server where users hold valid database credentials. The sources do not name affected versions or the specific feature involved, so the exposed configurations are unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000657,"input_tokens":4482,"output_tokens":418,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft advisory for CVE-2026-116933 to confirm affected SQL Server versions, patched builds and any non-default feature required.","search":"'-116933':14A,17A '-122':39B '-2026':13A,16A '10':76B '2022':20A,66B '2025':23A,68B '2026':77B '7.2':51B 'admin':86B 'admin-level':85B 'affect':60B 'allow':116C 'attack':46B,119C 'authent':45B 'author':8A,118C 'base':35B,110C 'buffer':36B,111C 'build':71B 'code':11A,55B,122C 'compromis':84B 'cve':12A,15A 'cvss':50B 'cwe':38B 'databas':90B 'engin':97B 'execut':121C 'exploit':103B 'found':107B 'h':53B 'heap':4A,34B,109C 'heap-bas':33B,108C 'high':48B 'host':28B 'instanc':69B 'let':6A,43B 'level':87B 'like':99B 'linux':24B 'login':88B 'manag':63B,89B 'microsoft':1A 'most':82B 'network':58B,125C 'nov':75B 'older':72B 'overflow':5A,37B,112C 'patch':95B 'poc':106B 'pr':52B 'privileg':49B 'provid':94B 'public':105B 'risk':80B 'run':10A,54B 'self':27B,62B 'self-host':26B 'self-manag':61B 'server':3A,19A,22A,31B,42B,65B,115C 'servic':91B 'skip':100B 'sql':2A,18A,21A,30B,41B,64B,114C 'sql-server':29B 'updat':78B 'user':9A 'window':32B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Microsoft SQL Server where users hold valid database credentials. The sources do not name affected versions or the specific feature involved, so the exposed configurations are unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["server2022","server2025","sqlserver2022","sqlserver2025"],"ptokens":["2022","2025","server","sql"],"labels":["high","linux","other","selfhosted","sqlserver","windows"],"campaign_type":null,"search_a":"'-116933':14A,17A '-2026':13A,16A '2022':20A '2025':23A 'author':8A 'code':11A 'cve':12A,15A 'heap':4A 'let':6A 'microsoft':1A 'overflow':5A 'run':10A 'server':3A,19A,22A 'sql':2A,18A,21A 'user':9A","search_b":"'-122':39B '10':76B '2022':66B '2025':68B '2026':77B '7.2':51B 'admin':86B 'admin-level':85B 'affect':60B 'attack':46B 'authent':45B 'base':35B 'buffer':36B 'build':71B 'code':55B 'compromis':84B 'cvss':50B 'cwe':38B 'databas':90B 'engin':97B 'exploit':103B 'found':107B 'h':53B 'heap':34B 'heap-bas':33B 'high':48B 'host':28B 'instanc':69B 'let':43B 'level':87B 'like':99B 'linux':24B 'login':88B 'manag':63B,89B 'most':82B 'network':58B 'nov':75B 'older':72B 'overflow':37B 'patch':95B 'poc':106B 'pr':52B 'privileg':49B 'provid':94B 'public':105B 'risk':80B 'run':54B 'self':27B,62B 'self-host':26B 'self-manag':61B 'server':31B,42B,65B 'servic':91B 'skip':100B 'sql':30B,41B,64B 'sql-server':29B 'updat':78B 'window':32B","search_c":"'allow':116C 'attack':119C 'author':118C 'base':110C 'buffer':111C 'code':122C 'execut':121C 'heap':109C 'heap-bas':108C 'network':125C 'overflow':112C 'server':115C 'sql':114C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116933","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116933","severity":null,"published_at":"2026-11-10T19:19:24+00:00","modified_at":"2026-11-10T19:19:24+00:00","first_seen_at":"2026-11-10T19:24:46+00:00","fetched_at":"2026-11-10T19:24:46+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116933:3196","url":"https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","severity":null,"published_at":"2026-11-10T23:35:33+00:00","modified_at":"2026-11-10T23:35:33+00:00","first_seen_at":"2026-11-10T23:35:33+00:00","fetched_at":"2026-11-10T23:35:33+00:00","note":"MSRC page is JS-only and returned nothing; ranges come from the CNA data via OpenCVE (not vendor-page verified). KB5129300 (2022 CU27) lists many Nov 2026 SQL CVEs but its list does not name 116933, so confirm the 2022 fix against MSRC. Nothing verified.","cites":["https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","https://app.opencve.io/cve/CVE-2026-116933"]}],"documents":[{"id":120312,"url":"https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","title":"KB5129300 SQL Server 2022 CU27 security update, Nov 10 2026","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":120380,"url":"https://app.opencve.io/cve/CVE-2026-116933","title":"OpenCVE CVE-2026-116933 (CNA affected ranges)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}