---
id: "CVE-2026-116935"
page: "https://infrastack.ai/live/CVE-2026-116935"
kind: "vulnerability"
aliases: ["CVE-2026-116935"]
title: "SQL Server: buffer over-read lets an authorized user read memory over network"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["microsoft", "runtime", "sql-server", "windows"]
not_affected_if: ["no-authorized-network-users", "no-sql-server-installed"]
published_at: "2026-11-10T19:19:25+00:00"
first_seen_at: "2026-11-10T19:24:46+00:00"
updated_at: "2026-11-10T19:57:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116935", "first_seen_at": "2026-11-10T19:24:46+00:00"}]
exploit_sources: []
---

# SQL Server: buffer over-read lets an authorized user read memory over network

Link for people: https://infrastack.ai/live/CVE-2026-116935 (this .md is for agents)

A buffer over-read in Microsoft SQL Server lets an attacker who already has valid access read memory beyond the intended buffer. The attack can be made across the network and discloses information, with no code execution stated in the sources.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the SQL Server version with `SELECT @@VERSION` and compare it to the fixed builds in the vendor advisory, which the sources do not list.

## Timeline

- 2026-11-10T19:24:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116935

## From the sources

Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_