{"id":"CVE-2026-116935","kind":"vulnerability","aliases":["CVE-2026-116935"],"related":[],"title":"SQL Server: buffer over-read lets an authorized user read memory over network","description":"Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.","summary":"A buffer over-read in Microsoft SQL Server lets an attacker who already has valid access read memory beyond the intended buffer. The attack can be made across the network and discloses information, with no code execution stated in the sources.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["microsoft","runtime","sql-server","windows"],"not_affected_if":["no-authorized-network-users","no-sql-server-installed"],"how_to_check":"- Check the SQL Server version with `SELECT @@VERSION` and compare it to the fixed builds in the vendor advisory, which the sources do not list.","fix":null,"status":"open","published_at":"2026-11-10T19:19:25+00:00","first_seen_at":"2026-11-10T19:24:46+00:00","triaged_at":"2026-11-10T19:57:49+00:00","updated_at":"2026-11-10T19:57:49+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T19:57:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SQL Server: buffer over-read lets an authorized user read memory over network","impact":"low","summary":"A buffer over-read in Microsoft SQL Server lets an attacker who already has valid access read memory beyond the intended buffer. The attack can be made across the network and discloses information, with no code execution stated in the sources.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["sql-server","windows","microsoft"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker reads sensitive server memory over the network","analyst_note":"Find Microsoft's MSRC advisory for CVE-2026-116935 to confirm affected builds, fixed versions and any patch.","how_to_check":"- Check the SQL Server version with `SELECT @@VERSION` and compare it to the fixed builds in the vendor advisory, which the sources do not list.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-sql-server-installed","no-authorized-network-users"],"who_is_affected":"Organisations running Microsoft SQL Server where users hold valid database credentials and can reach the server over the network. The sources do not name affected builds or fixed versions, so the exact exposure is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000695,"input_tokens":4477,"output_tokens":495,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116935':17A,20A '-2026':16A,19A 'access':43B 'across':55B 'allow':76C 'alreadi':40B 'attack':38B,51B,79C 'author':9A,78C 'beyond':46B 'buffer':3A,28B,49B,69C 'code':63B 'cve':15A,18A 'disclos':59B,81C 'execut':64B 'inform':60B,82C 'intend':48B 'let':7A,36B 'made':54B 'memori':12A,45B 'microsoft':21B,33B 'network':14A,57B,85C 'over-read':4A,29B,70C 'read':6A,11A,31B,44B,72C 'runtim':22B 'server':2A,25B,35B,75C 'sourc':68B 'sql':1A,24B,34B,74C 'sql-server':23B 'state':65B 'user':10A 'valid':42B 'window':26B","nicknames":[],"mitigations":[],"who_affected":"Organisations running Microsoft SQL Server where users hold valid database credentials and can reach the server over the network. The sources do not name affected builds or fixed versions, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","microsoft","runtime","sqlserver","windows"],"campaign_type":null,"search_a":"'-116935':17A,20A '-2026':16A,19A 'author':9A 'buffer':3A 'cve':15A,18A 'let':7A 'memori':12A 'network':14A 'over-read':4A 'read':6A,11A 'server':2A 'sql':1A 'user':10A","search_b":"'access':43B 'across':55B 'alreadi':40B 'attack':38B,51B 'beyond':46B 'buffer':28B,49B 'code':63B 'disclos':59B 'execut':64B 'inform':60B 'intend':48B 'let':36B 'made':54B 'memori':45B 'microsoft':21B,33B 'network':57B 'over-read':29B 'read':31B,44B 'runtim':22B 'server':25B,35B 'sourc':68B 'sql':24B,34B 'sql-server':23B 'state':65B 'valid':42B 'window':26B","search_c":"'allow':76C 'attack':79C 'author':78C 'buffer':69C 'disclos':81C 'inform':82C 'network':85C 'over-read':70C 'read':72C 'server':75C 'sql':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116935","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116935","severity":null,"published_at":"2026-11-10T19:19:25+00:00","modified_at":"2026-11-10T19:19:25+00:00","first_seen_at":"2026-11-10T19:24:46+00:00","fetched_at":"2026-11-10T19:24:46+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}