{"id":"CVE-2026-116941","kind":"vulnerability","aliases":["CVE-2026-116941"],"related":[],"title":"SQL Server: heap buffer overflow lets an authorized user run code","description":"Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.","summary":"A heap-based buffer overflow in Microsoft SQL Server lets an attacker with low-privilege authorized access execute code over the network (CVSS 8.8, CWE-122). Microsoft fixed it in the November 10, 2026 security updates. No exploitation or public PoC is reported; Microsoft rates exploit code maturity as unproven.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SQL Server 2022","fixed":["16.0.4315.2","16.0.1220.3"],"affected":"CU: >= 16.0.4003.1, < 16.0.4315.2; GDR: >= 16.0.0, < 16.0.1220.3","ecosystem":"vendor"},{"name":"SQL Server 2019","fixed":["15.0.4510.2","15.0.2210.4"],"affected":"CU: >= 15.0.4003.23, < 15.0.4510.2; GDR: >= 15.0.0, < 15.0.2210.4","ecosystem":"vendor"},{"name":"SQL Server 2017","fixed":["14.0.3570.2","14.0.2150.2"],"affected":"CU: >= 14.0.3006.16, < 14.0.3570.2; GDR: >= 14.0.0, < 14.0.2150.2","ecosystem":"vendor"},{"name":"SQL Server 2025","fixed":["17.0.5045.3","17.0.1155.3"],"affected":"CU: >= 17.0.4006.0, < 17.0.5045.3; GDR: >= 17.0.1050.2, < 17.0.1155.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["linux","microsoft","runtime","self-hosted","sql-server","windows"],"not_affected_if":["no-network-access","patched-build"],"how_to_check":"Run SELECT @@VERSION (or SERVERPROPERTY('ProductVersion')) on each instance and compare with the fixed builds. Affected: 2017 GDR <14.0.2150.2, 2017 CU31 <14.0.3570.2, 2019 GDR <15.0.2210.4, 2019 CU32 <15.0.4510.2, 2022 GDR <16.0.1220.3, 2022 CU27 <16.0.4315.2, 2025 GDR <17.0.1155.3, 2025 CU10 <17.0.5045.3 (builds per the CVE record; only 2022 CU27 confirmed on a Microsoft KB page).","fix":"Install the November 2026 SQL Server security update for your branch: 2022 CU27 -> KB5129300 (16.0.4315.2, confirmed on Microsoft's KB page). Other branches: 2017 GDR 14.0.2150.2 / CU 14.0.3570.2, 2019 GDR 15.0.2210.4 / CU 15.0.4510.2, 2022 GDR 16.0.1220.3, 2025 GDR 17.0.1155.3 / CU10 17.0.5045.3. Known issue in KB5129300: sys.dm_exec_requests may fault during database recovery; trace flag 4696 is Microsoft's mitigation for that.","status":"open","published_at":"2026-11-10T19:19:27+00:00","first_seen_at":"2026-11-10T19:24:46+00:00","triaged_at":"2026-11-10T19:30:23+00:00","updated_at":"2026-11-10T23:34:28+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-10T19:30:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SQL Server: heap buffer overflow lets an authorized user run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft SQL Server lets an attacker who already has authorized access run code over the network. The sources give a CVSS score of 8.8 and do not name affected versions or a fix.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["sql-server","windows","microsoft"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker runs code on the database server over the network","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-116941 for affected SQL Server versions, the fixed build and any mitigation.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Microsoft SQL Server that allow authenticated users to reach it over the network. The sources do not name affected versions or configurations, so which deployments are exposed is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000659,"input_tokens":4482,"output_tokens":421,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-116941 for affected SQL Server versions, the fixed build and any mitigation.","search":"'-116941':14A,17A '-122':67B '-2026':13A,16A '10':74B '2017':26A '2019':23A '2022':20A '2025':29A '2026':75B '8.8':65B 'access':58B 'allow':100C 'attack':52B,103C 'author':8A,57B,102C 'base':43B,94C 'buffer':4A,44B,95C 'code':11A,60B,88B,106C 'cve':12A,15A 'cvss':64B 'cwe':66B 'execut':59B,105C 'exploit':79B,87B 'fix':69B 'heap':3A,42B,93C 'heap-bas':41B,92C 'host':35B 'let':6A,50B 'linux':30B 'low':55B 'low-privileg':54B 'matur':89B 'microsoft':31B,47B,68B,85B 'network':63B,109C 'novemb':73B 'overflow':5A,45B,96C 'poc':82B 'privileg':56B 'public':81B 'rate':86B 'report':84B 'run':10A 'runtim':32B 'secur':76B 'self':34B 'self-host':33B 'server':2A,19A,22A,25A,28A,38B,49B,99C 'sql':1A,18A,21A,24A,27A,37B,48B,98C 'sql-server':36B 'unproven':91B 'updat':77B 'user':9A 'window':39B","nicknames":[],"mitigations":[],"who_affected":"Any SQL Server 2017, 2019, 2022 or 2025 instance (Windows; KB5129300 also covers Linux for 2022) on a build below the fixed one, where an attacker holds or can obtain a valid low-privilege login and can reach the database port. Instances reachable only by trusted apps with tightly held credentials are lower risk; managed cloud databases (Azure SQL) are not listed in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["server2017","server2019","server2022","server2025","sqlserver2017","sqlserver2019","sqlserver2022","sqlserver2025"],"ptokens":["2017","2019","2022","2025","server","sql"],"labels":["high","linux","microsoft","runtime","selfhosted","sqlserver","windows"],"campaign_type":null,"search_a":"'-116941':14A,17A '-2026':13A,16A '2017':26A '2019':23A '2022':20A '2025':29A 'author':8A 'buffer':4A 'code':11A 'cve':12A,15A 'heap':3A 'let':6A 'overflow':5A 'run':10A 'server':2A,19A,22A,25A,28A 'sql':1A,18A,21A,24A,27A 'user':9A","search_b":"'-122':67B '10':74B '2026':75B '8.8':65B 'access':58B 'attack':52B 'author':57B 'base':43B 'buffer':44B 'code':60B,88B 'cvss':64B 'cwe':66B 'execut':59B 'exploit':79B,87B 'fix':69B 'heap':42B 'heap-bas':41B 'host':35B 'let':50B 'linux':30B 'low':55B 'low-privileg':54B 'matur':89B 'microsoft':31B,47B,68B,85B 'network':63B 'novemb':73B 'overflow':45B 'poc':82B 'privileg':56B 'public':81B 'rate':86B 'report':84B 'runtim':32B 'secur':76B 'self':34B 'self-host':33B 'server':38B,49B 'sql':37B,48B 'sql-server':36B 'unproven':91B 'updat':77B 'window':39B","search_c":"'allow':100C 'attack':103C 'author':102C 'base':94C 'buffer':95C 'code':106C 'execut':105C 'heap':93C 'heap-bas':92C 'network':109C 'overflow':96C 'server':99C 'sql':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116941","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116941","severity":null,"published_at":"2026-11-10T19:19:27+00:00","modified_at":"2026-11-10T19:19:27+00:00","first_seen_at":"2026-11-10T19:24:46+00:00","fetched_at":"2026-11-10T19:24:46+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116941:3191","url":"https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","severity":null,"published_at":"2026-11-10T23:34:28+00:00","modified_at":"2026-11-10T23:34:28+00:00","first_seen_at":"2026-11-10T23:34:28+00:00","fetched_at":"2026-11-10T23:34:28+00:00","note":"MSRC page unreadable by tools. Microsoft KB5129300 confirms SQL Server 2022 CU27 fix 16.0.4315.2 lists this CVE; other fixed builds come from the CVE record as mirrored by OpenCVE, not read on Microsoft's own page, so nothing marked verified. No exploitation or PoC seen (CVSS E:U).","cites":["https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","https://app.opencve.io/cve/CVE-2026-116941"]}],"documents":[{"id":120312,"url":"https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","title":"KB5129300 SQL Server 2022 CU27 security update, Nov 10 2026","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":120374,"url":"https://app.opencve.io/cve/CVE-2026-116941","title":"OpenCVE: CVE-2026-116941 (mirrors Microsoft CVE record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}