{"id":"CVE-2026-116936","kind":"vulnerability","aliases":["CVE-2026-116936"],"related":[],"title":"Microsoft SQL Server: stack overflow lets an authorized user run code remotely","description":"Stack-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.","summary":"Stack-based buffer overflow (CWE-121) in Microsoft SQL Server lets an attacker with high privileges (CVSS PR:H) send crafted network traffic and run code on the database server. Fixed in the November 10, 2026 security updates. Not known to be exploited.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"sql-server-2022","fixed":["16.0.4315.2","16.0.1220.3"],"affected":">= 16.0.4003.1, < 16.0.4315.2 (CU27); >= 16.0.0, < 16.0.1220.3 (GDR)","ecosystem":"vendor"},{"name":"sql-server-2019","fixed":["15.0.4510.2","15.0.2210.4"],"affected":">= 15.0.4003.23, < 15.0.4510.2 (CU32); >= 15.0.0, < 15.0.2210.4 (GDR)","ecosystem":"vendor"},{"name":"sql-server-2017","fixed":["14.0.3570.2","14.0.2150.2"],"affected":">= 14.0.3006.16, < 14.0.3570.2 (CU31); >= 14.0.0, < 14.0.2150.2 (GDR)","ecosystem":"vendor"},{"name":"sql-server-2025","fixed":["17.0.5045.3","17.0.1155.3"],"affected":">= 17.0.4006.0, < 17.0.5045.3 (CU10); >= 17.0.1050.2, < 17.0.1155.3 (GDR)","ecosystem":"vendor"}],"ecosystems":[],"tags":["database","infrastructure","linux","self-hosted","sql-server","windows"],"not_affected_if":["managed-hosting"],"how_to_check":"Run SELECT @@VERSION (or SELECT SERVERPROPERTY('ProductVersion')) on each instance and compare to the fixed builds: 2017 GDR 14.0.2150.2 / CU31 14.0.3570.2; 2019 GDR 15.0.2210.4 / CU32 15.0.4510.2; 2022 GDR 16.0.1220.3 / CU27 16.0.4315.2; 2025 GDR 17.0.1155.3 / CU10 17.0.5045.3. Lower builds are affected. Only the 2022 CU27 build is confirmed on a Microsoft page (KB5129300); confirm others on the MSRC entry.","fix":"Install the November 10, 2026 SQL Server security update for your branch. SQL Server 2022 CU27: KB5129300, build 16.0.4315.2 (Windows and Linux). Other branches: see the build list in how-to-check and MSRC.","status":"open","published_at":"2026-11-10T19:19:25+00:00","first_seen_at":"2026-11-10T19:24:46+00:00","triaged_at":"2026-11-10T19:47:53+00:00","updated_at":"2026-11-10T23:35:35+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:47:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft SQL Server: stack overflow lets an authorized user run code remotely","impact":"high","summary":"A stack-based buffer overflow in Microsoft SQL Server lets an attacker who already has authorized access send crafted network traffic. Successful exploitation can run code on the database server.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["sql-server","windows","database"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Code runs on the database server with attacker-chosen privileges","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-116936 for affected SQL Server builds, required privileges, and the patch.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Microsoft SQL Server reachable over the network. The sources do not name affected versions or the specific configuration, so the exact exposure is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000652,"input_tokens":4482,"output_tokens":407,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-116936 for affected SQL Server builds, required privileges, and the patch.","search":"'-116936':15A,18A '-121':51B '-2026':14A,17A '10':80B '2017':30A '2019':26A '2022':22A '2025':34A '2026':81B 'allow':97C 'attack':58B,100C 'author':8A,99C 'base':47B,91C 'buffer':48B,92C 'code':11A,71B,103C 'craft':66B 'cve':13A,16A 'cvss':62B 'cwe':50B 'databas':35B,74B 'execut':102C 'exploit':88B 'fix':76B 'h':64B 'high':60B 'host':40B 'infrastructur':36B 'known':85B 'let':6A,56B 'linux':37B 'microsoft':1A,53B 'network':67B,106C 'novemb':79B 'overflow':5A,49B,93C 'pr':63B 'privileg':61B 'remot':12A 'run':10A,70B 'secur':82B 'self':39B 'self-host':38B 'send':65B 'server':3A,21A,25A,29A,33A,43B,55B,75B,96C 'sql':2A,20A,24A,28A,32A,42B,54B,95C 'sql-server':19A,23A,27A,31A,41B 'stack':4A,46B,90C 'stack-bas':45B,89C 'traffic':68B 'updat':83B 'user':9A 'window':44B","nicknames":[],"mitigations":[],"who_affected":"Teams running Microsoft SQL Server 2017, 2019, 2022 or 2025 on builds below the November 2026 security updates. Exploitation needs an account with high privileges and network access to the instance, so exposure is highest where SQL logins are shared or the port is reachable from untrusted networks. Skip it if you use a managed service where the provider patches the engine.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["sqlserver2017","sqlserver2019","sqlserver2022","sqlserver2025"],"ptokens":["2017","2019","2022","2025","server","sql"],"labels":["database","high","infrastructure","linux","selfhosted","sqlserver","windows"],"campaign_type":null,"search_a":"'-116936':15A,18A '-2026':14A,17A '2017':30A '2019':26A '2022':22A '2025':34A 'author':8A 'code':11A 'cve':13A,16A 'let':6A 'microsoft':1A 'overflow':5A 'remot':12A 'run':10A 'server':3A,21A,25A,29A,33A 'sql':2A,20A,24A,28A,32A 'sql-server':19A,23A,27A,31A 'stack':4A 'user':9A","search_b":"'-121':51B '10':80B '2026':81B 'attack':58B 'base':47B 'buffer':48B 'code':71B 'craft':66B 'cvss':62B 'cwe':50B 'databas':35B,74B 'exploit':88B 'fix':76B 'h':64B 'high':60B 'host':40B 'infrastructur':36B 'known':85B 'let':56B 'linux':37B 'microsoft':53B 'network':67B 'novemb':79B 'overflow':49B 'pr':63B 'privileg':61B 'run':70B 'secur':82B 'self':39B 'self-host':38B 'send':65B 'server':43B,55B,75B 'sql':42B,54B 'sql-server':41B 'stack':46B 'stack-bas':45B 'traffic':68B 'updat':83B 'window':44B","search_c":"'allow':97C 'attack':100C 'author':99C 'base':91C 'buffer':92C 'code':103C 'execut':102C 'network':106C 'overflow':93C 'server':96C 'sql':95C 'stack':90C 'stack-bas':89C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116936","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116936","severity":null,"published_at":"2026-11-10T19:19:25+00:00","modified_at":"2026-11-10T19:19:26+00:00","first_seen_at":"2026-11-10T19:24:46+00:00","fetched_at":"2026-11-10T19:24:46+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116936:3194","url":"https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","severity":null,"published_at":"2026-11-10T23:35:35+00:00","modified_at":"2026-11-10T23:35:35+00:00","first_seen_at":"2026-11-10T23:35:35+00:00","fetched_at":"2026-11-10T23:35:35+00:00","note":"MSRC page unreadable via tools; Microsoft KB5129300 (SQL 2022 CU27, 16.0.4315.2) lists this CVE as fixed; other branches' fixed builds from OpenCVE CVE record (not vendor page), so nothing marked verified. No exploitation or PoC seen (CVSS E:U).","cites":["https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","https://app.opencve.io/cve/CVE-2026-116936"]}],"documents":[{"id":120312,"url":"https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","title":"KB5129300 SQL Server 2022 CU27 security update, Nov 10 2026","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":120382,"url":"https://app.opencve.io/cve/CVE-2026-116936","title":"OpenCVE: CVE-2026-116936 (CVE record affected versions)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}