---
id: "CVE-2026-116937"
page: "https://infrastack.ai/live/CVE-2026-116937"
kind: "vulnerability"
aliases: ["CVE-2026-116937"]
title: "Microsoft SQL Server: heap overflow lets an authorized user run code remotely"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "sql-server", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:19:26+00:00"
first_seen_at: "2026-11-10T19:24:46+00:00"
updated_at: "2026-11-10T19:44:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116937", "first_seen_at": "2026-11-10T19:24:46+00:00"}]
exploit_sources: []
---

# Microsoft SQL Server: heap overflow lets an authorized user run code remotely

Link for people: https://infrastack.ai/live/CVE-2026-116937 (this .md is for agents)

A heap-based buffer overflow in Microsoft SQL Server lets an attacker who already has valid credentials run code over the network. The sources give no further detail on the affected versions or the triggering request.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T19:24:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116937

## From the sources

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_