{"id":"CVE-2026-116942","kind":"vulnerability","aliases":["CVE-2026-116942"],"related":[],"title":"Microsoft SQL Server: heap overflow lets an authorized user run code remotely","description":"Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.","summary":"A heap-based buffer overflow in Microsoft SQL Server lets a user with valid access send crafted requests over the network. A successful attack can run code on the database server.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","runtime","sql-server","windows"],"not_affected_if":["local-only-access","no-sql-server"],"how_to_check":"- Check the installed SQL Server version with `SELECT @@VERSION` and compare it against the fixed builds listed by Microsoft (unknown from the sources given)\n- Confirm whether SQL Server is reachable from the network rather than only from the local host (unknown)","fix":null,"status":"open","published_at":"2026-11-10T19:19:27+00:00","first_seen_at":"2026-11-10T19:24:47+00:00","triaged_at":"2026-11-10T19:30:23+00:00","updated_at":"2026-11-10T19:30:23+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T19:30:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft SQL Server: heap overflow lets an authorized user run code remotely","impact":"high","summary":"A heap-based buffer overflow in Microsoft SQL Server lets a user with valid access send crafted requests over the network. A successful attack can run code on the database server.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["sql-server","windows","database"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs code on the database server over the network","analyst_note":"Find the affected and fixed SQL Server builds in the Microsoft Security Update Guide entry for CVE-2026-116942.","how_to_check":"- Check the installed SQL Server version with `SELECT @@VERSION` and compare it against the fixed builds listed by Microsoft (unknown from the sources given)\n- Confirm whether SQL Server is reachable from the network rather than only from the local host (unknown)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["local-only-access","no-sql-server"],"who_is_affected":"Organizations running Microsoft SQL Server that accept network connections from users with database accounts. The sources do not list affected builds, so the exact exposure is unknown. Servers reachable only locally are lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000707,"input_tokens":4482,"output_tokens":518,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the affected and fixed SQL Server builds in the Microsoft Security Update Guide entry for CVE-2026-116942.","search":"'-116942':15A,18A '-2026':14A,17A 'access':40B 'allow':65C 'attack':49B,68C 'author':8A,67C 'base':28B,59C 'buffer':29B,60C 'code':11A,52B,71C 'craft':42B 'cve':13A,16A 'databas':19B,55B 'execut':70C 'heap':4A,27B,58C 'heap-bas':26B,57C 'let':6A,35B 'microsoft':1A,32B 'network':46B,74C 'overflow':5A,30B,61C 'remot':12A 'request':43B 'run':10A,51B 'runtim':20B 'send':41B 'server':3A,23B,34B,56B,64C 'sql':2A,22B,33B,63C 'sql-server':21B 'success':48B 'user':9A,37B 'valid':39B 'window':24B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Microsoft SQL Server that accept network connections from users with database accounts. The sources do not list affected builds, so the exact exposure is unknown. Servers reachable only locally are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","runtime","sqlserver","windows"],"campaign_type":null,"search_a":"'-116942':15A,18A '-2026':14A,17A 'author':8A 'code':11A 'cve':13A,16A 'heap':4A 'let':6A 'microsoft':1A 'overflow':5A 'remot':12A 'run':10A 'server':3A 'sql':2A 'user':9A","search_b":"'access':40B 'attack':49B 'base':28B 'buffer':29B 'code':52B 'craft':42B 'databas':19B,55B 'heap':27B 'heap-bas':26B 'let':35B 'microsoft':32B 'network':46B 'overflow':30B 'request':43B 'run':51B 'runtim':20B 'send':41B 'server':23B,34B,56B 'sql':22B,33B 'sql-server':21B 'success':48B 'user':37B 'valid':39B 'window':24B","search_c":"'allow':65C 'attack':68C 'author':67C 'base':59C 'buffer':60C 'code':71C 'execut':70C 'heap':58C 'heap-bas':57C 'network':74C 'overflow':61C 'server':64C 'sql':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116942","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116942","severity":null,"published_at":"2026-11-10T19:19:27+00:00","modified_at":"2026-11-10T19:19:27+00:00","first_seen_at":"2026-11-10T19:24:47+00:00","fetched_at":"2026-11-10T19:24:47+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}