{"id":"CVE-2026-116937","kind":"vulnerability","aliases":["CVE-2026-116937"],"related":[],"title":"Microsoft SQL Server: heap overflow lets an authorized user run code remotely","description":"Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in SQL Server (CWE-122) lets an authenticated low-privilege attacker run code over the network; Microsoft rates it CVSS 7.5 with high attack complexity. Fixed in the November 10, 2026 SQL Server security updates. Not known to be exploited.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SQL Server 2017 (CU31)","fixed":["14.0.3570.2"],"affected":">= 14.0.3006.16, < 14.0.3570.2","ecosystem":"vendor"},{"name":"SQL Server 2019 (GDR)","fixed":["15.0.2210.4"],"affected":">= 15.0.0, < 15.0.2210.4","ecosystem":"vendor"},{"name":"SQL Server 2019 (CU32)","fixed":["15.0.4510.2"],"affected":">= 15.0.4003.23, < 15.0.4510.2","ecosystem":"vendor"},{"name":"SQL Server 2022 (GDR)","fixed":["16.0.1220.3"],"affected":">= 16.0.0, < 16.0.1220.3","ecosystem":"vendor"},{"name":"SQL Server 2022 (CU27)","fixed":["16.0.4315.2"],"affected":">= 16.0.4003.1, < 16.0.4315.2","ecosystem":"vendor"},{"name":"SQL Server 2025 (CU10)","fixed":["17.0.5045.3"],"affected":">= 17.0.4006.0, < 17.0.5045.3","ecosystem":"vendor"},{"name":"SQL Server 2025 (GDR)","fixed":["17.0.1155.3"],"affected":">= 17.0.1050.2, < 17.0.1155.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["microsoft","other","self-hosted","sql-server","windows"],"not_affected_if":["managed-hosting","patched-build"],"how_to_check":"Run SELECT @@VERSION (or SERVERPROPERTY('ProductVersion')) and compare with the fixed builds: 2017 CU31 14.0.3570.2; 2019 GDR 15.0.2210.4; 2019 CU32 15.0.4510.2; 2022 GDR 16.0.1220.3; 2022 CU27 16.0.4315.2; 2025 CU10 17.0.5045.3; 2025 GDR 17.0.1155.3. A build below the fix for its branch is exposed. Confirm on the MSRC page for this CVE.","fix":"Install the November 10, 2026 SQL Server security update for your branch (GDR or CU), e.g. KB5129300 for 2022 CU27 (16.0.4315.2). No workaround is documented.","status":"open","published_at":"2026-11-10T19:19:26+00:00","first_seen_at":"2026-11-10T19:24:46+00:00","triaged_at":"2026-11-10T19:44:49+00:00","updated_at":"2026-11-10T23:35:19+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T19:44:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft SQL Server: heap overflow lets an authorized user run code remotely","impact":"high","summary":"A heap-based buffer overflow in Microsoft SQL Server lets an attacker who already has valid credentials run code over the network. The sources give no further detail on the affected versions or the triggering request.","audience":"businesses","category":"other","nicknames":[],"who_cares":["sql-server","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs code on the database server over the network.","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-116937 to confirm affected SQL Server versions, fixed builds and any mitigations.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organisations running Microsoft SQL Server reachable over a network, where attackers may hold valid credentials. The sources do not name affected versions or configurations, so the exact scope is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000657,"input_tokens":4482,"output_tokens":417,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-116937 to confirm affected SQL Server versions, fixed builds and any mitigations.","search":"'-116937':15A,18A '-122':65B '-2026':14A,17A '10':91B '2017':21A '2019':25A,29A '2022':33A,37A '2025':41A,45A '2026':92B '7.5':82B 'allow':110C 'attack':72B,85B,113C 'authent':68B 'author':8A,112C 'base':58B,104C 'buffer':59B,105C 'code':11A,74B,116C 'complex':86B 'cu10':42A 'cu27':38A 'cu31':22A 'cu32':30A 'cve':13A,16A 'cvss':81B 'cwe':64B 'execut':115C 'exploit':101B 'fix':87B 'gdr':26A,34A,46A 'heap':4A,57B,103C 'heap-bas':56B,102C 'high':84B 'host':51B 'known':98B 'let':6A,66B 'low':70B 'low-privileg':69B 'microsoft':1A,47B,78B 'network':77B,119C 'novemb':90B 'overflow':5A,60B,106C 'privileg':71B 'rate':79B 'remot':12A 'run':10A,73B 'secur':95B 'self':50B 'self-host':49B 'server':3A,20A,24A,28A,32A,36A,40A,44A,54B,63B,94B,109C 'sql':2A,19A,23A,27A,31A,35A,39A,43A,53B,62B,93B,108C 'sql-server':52B 'updat':96B 'user':9A 'window':55B","nicknames":[],"mitigations":[],"who_affected":"Any SQL Server 2017, 2019, 2022 or 2025 instance on a build below the fixed ones, where an attacker can authenticate and reach the server over the network. Microsoft's record lists the x64 CU and GDR branches; managed services patched by the provider are probably covered, but check with the provider. Servers not reachable by untrusted users lower the risk but should still be patched.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["server2017cu31","server2019cu32","server2019gdr","server2022cu27","server2022gdr","server2025cu10","server2025gdr","sqlserver2017cu31","sqlserver2019cu32","sqlserver2019gdr","sqlserver2022cu27","sqlserver2022gdr","sqlserver2025cu10","sqlserver2025gdr"],"ptokens":["2017","2019","2022","2025","cu10","cu27","cu31","cu32","gdr","server","sql"],"labels":["high","microsoft","other","selfhosted","sqlserver","windows"],"campaign_type":null,"search_a":"'-116937':15A,18A '-2026':14A,17A '2017':21A '2019':25A,29A '2022':33A,37A '2025':41A,45A 'author':8A 'code':11A 'cu10':42A 'cu27':38A 'cu31':22A 'cu32':30A 'cve':13A,16A 'gdr':26A,34A,46A 'heap':4A 'let':6A 'microsoft':1A 'overflow':5A 'remot':12A 'run':10A 'server':3A,20A,24A,28A,32A,36A,40A,44A 'sql':2A,19A,23A,27A,31A,35A,39A,43A 'user':9A","search_b":"'-122':65B '10':91B '2026':92B '7.5':82B 'attack':72B,85B 'authent':68B 'base':58B 'buffer':59B 'code':74B 'complex':86B 'cvss':81B 'cwe':64B 'exploit':101B 'fix':87B 'heap':57B 'heap-bas':56B 'high':84B 'host':51B 'known':98B 'let':66B 'low':70B 'low-privileg':69B 'microsoft':47B,78B 'network':77B 'novemb':90B 'overflow':60B 'privileg':71B 'rate':79B 'run':73B 'secur':95B 'self':50B 'self-host':49B 'server':54B,63B,94B 'sql':53B,62B,93B 'sql-server':52B 'updat':96B 'window':55B","search_c":"'allow':110C 'attack':113C 'author':112C 'base':104C 'buffer':105C 'code':116C 'execut':115C 'heap':103C 'heap-bas':102C 'network':119C 'overflow':106C 'server':109C 'sql':108C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116937","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116937","severity":null,"published_at":"2026-11-10T19:19:26+00:00","modified_at":"2026-11-10T19:19:26+00:00","first_seen_at":"2026-11-10T19:24:46+00:00","fetched_at":"2026-11-10T19:24:46+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116937:3193","url":"https://app.opencve.io/cve/CVE-2026-116937","severity":null,"published_at":"2026-11-10T23:35:19+00:00","modified_at":"2026-11-10T23:35:19+00:00","first_seen_at":"2026-11-10T23:35:19+00:00","fetched_at":"2026-11-10T23:35:19+00:00","note":"MSRC page is JS-only and could not be read; affected ranges and fixed builds taken from the Microsoft CNA record as mirrored by OpenCVE/NVD. KB5129300 (2022 CU27, 16.0.4315.2) is the Nov 10 security update but its visible CVE list omits this id, so nothing verified. No exploitation or PoC seen.","cites":["https://app.opencve.io/cve/CVE-2026-116937","https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026"]}],"documents":[{"id":120377,"url":"https://app.opencve.io/cve/CVE-2026-116937","title":"OpenCVE: CVE-2026-116937 (mirrors the Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":120312,"url":"https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","title":"KB5129300 SQL Server 2022 CU27 security update, Nov 10 2026","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}