{"id":"CVE-2026-116944","kind":"vulnerability","aliases":["CVE-2026-116944"],"related":[],"title":"Microsoft SQL Server: heap overflow lets an authorized user gain higher privileges","description":"Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.","summary":"A heap-based buffer overflow in Microsoft SQL Server lets an attacker who already has an account raise their privileges over the network. The sources do not describe the exact code path or the affected versions.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"sql-server-2022-cu27","fixed":["16.0.4315.2"],"affected":">= 16.0.4003.1, < 16.0.4315.2","ecosystem":"vendor"},{"name":"sql-server-2022-gdr","fixed":["16.0.1220.3"],"affected":">= 16.0.0, < 16.0.1220.3","ecosystem":"vendor"},{"name":"sql-server-2019-cu32","fixed":["15.0.4510.2"],"affected":">= 15.0.4003.23, < 15.0.4510.2","ecosystem":"vendor"},{"name":"sql-server-2019-gdr","fixed":["15.0.2210.4"],"affected":">= 15.0.0, < 15.0.2210.4","ecosystem":"vendor"},{"name":"sql-server-2017-cu31","fixed":["14.0.3570.2"],"affected":">= 14.0.3006.16, < 14.0.3570.2","ecosystem":"vendor"},{"name":"sql-server-2017-gdr","fixed":["14.0.2150.2"],"affected":">= 14.0.0, < 14.0.2150.2","ecosystem":"vendor"},{"name":"sql-server-2025-cu10","fixed":["17.0.5045.3"],"affected":">= 17.0.4006.0, < 17.0.5045.3","ecosystem":"vendor"},{"name":"sql-server-2025-gdr","fixed":["17.0.1155.3"],"affected":">= 17.0.1050.2, < 17.0.1155.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","microsoft","self-hosted","sql-server","windows"],"not_affected_if":["managed-hosting","patched-build"],"how_to_check":"Run SELECT @@VERSION (or SERVERPROPERTY('ProductVersion')) and compare with the fixed build for your branch (GDR or CU track). Lower than the fixed build means exposed. Only logins with high privileges can exploit it (CVSS PR:H).","fix":"Install the November 10, 2026 SQL Server security update for your branch. SQL Server 2022 CU27: 16.0.4315.2 (KB5129300, confirmed on Microsoft's KB). Per CNA data: 2017 GDR 14.0.2150.2, 2017 CU31 14.0.3570.2, 2019 GDR 15.0.2210.4, 2019 CU32 15.0.4510.2, 2022 GDR 16.0.1220.3, 2025 CU10 17.0.5045.3, 2025 GDR 17.0.1155.3. Check the MSRC entry for the KB of your branch.","status":"open","published_at":"2026-11-10T19:19:27+00:00","first_seen_at":"2026-11-10T19:24:47+00:00","triaged_at":"2026-11-10T19:47:52+00:00","updated_at":"2026-11-10T23:33:16+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:47:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft SQL Server: heap overflow lets an authorized user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in Microsoft SQL Server lets an attacker who already has an account raise their privileges over the network. The sources do not describe the exact code path or the affected versions.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["sql-server","windows","microsoft"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user gains elevated database privileges over the network","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-116944 for affected SQL Server builds, the fixed cumulative update, and any mitigation.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Microsoft SQL Server where users hold valid database accounts, since the attacker must already be authorized. The sources do not list affected versions or configurations, so the exact exposure is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000666,"input_tokens":4488,"output_tokens":434,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-116944 for affected SQL Server builds, the fixed cumulative update, and any mitigation.","search":"'-116944':15A,18A '-2026':14A,17A '2017':42A,47A '2019':32A,37A '2022':22A,27A '2025':52A,57A 'account':85B 'affect':103B 'allow':113C 'alreadi':82B 'attack':80B,116C 'author':8A,115C 'base':71B,107C 'buffer':72B,108C 'code':99B 'cu10':53A 'cu27':23A 'cu31':43A 'cu32':33A 'cve':13A,16A 'describ':96B 'elev':118C 'exact':98B 'gain':10A 'gdr':28A,38A,48A,58A 'heap':4A,70B,106C 'heap-bas':69B,105C 'higher':11A 'host':63B 'infrastructur':59B 'let':6A,78B 'microsoft':1A,60B,75B 'network':91B,122C 'overflow':5A,73B,109C 'path':100B 'privileg':12A,88B,119C 'rais':86B 'self':62B 'self-host':61B 'server':3A,21A,26A,31A,36A,41A,46A,51A,56A,66B,77B,112C 'sourc':93B 'sql':2A,20A,25A,30A,35A,40A,45A,50A,55A,65B,76B,111C 'sql-server':19A,24A,29A,34A,39A,44A,49A,54A,64B 'user':9A 'version':104B 'window':67B","nicknames":[],"mitigations":[],"who_affected":"Self-managed SQL Server 2017, 2019, 2022 and 2025 (Windows and Linux for 2022) below the November 2026 security update builds. The attacker needs an existing high-privilege login and network access to the instance, so exposure is greatest where many admins or shared elevated accounts exist. Managed services where the provider patches the engine can skip it unless you run the engine yourself.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["sqlserver2017cu31","sqlserver2017gdr","sqlserver2019cu32","sqlserver2019gdr","sqlserver2022cu27","sqlserver2022gdr","sqlserver2025cu10","sqlserver2025gdr"],"ptokens":["2017","2019","2022","2025","cu10","cu27","cu31","cu32","gdr","server","sql"],"labels":["high","infrastructure","microsoft","selfhosted","sqlserver","windows"],"campaign_type":null,"search_a":"'-116944':15A,18A '-2026':14A,17A '2017':42A,47A '2019':32A,37A '2022':22A,27A '2025':52A,57A 'author':8A 'cu10':53A 'cu27':23A 'cu31':43A 'cu32':33A 'cve':13A,16A 'gain':10A 'gdr':28A,38A,48A,58A 'heap':4A 'higher':11A 'let':6A 'microsoft':1A 'overflow':5A 'privileg':12A 'server':3A,21A,26A,31A,36A,41A,46A,51A,56A 'sql':2A,20A,25A,30A,35A,40A,45A,50A,55A 'sql-server':19A,24A,29A,34A,39A,44A,49A,54A 'user':9A","search_b":"'account':85B 'affect':103B 'alreadi':82B 'attack':80B 'base':71B 'buffer':72B 'code':99B 'describ':96B 'exact':98B 'heap':70B 'heap-bas':69B 'host':63B 'infrastructur':59B 'let':78B 'microsoft':60B,75B 'network':91B 'overflow':73B 'path':100B 'privileg':88B 'rais':86B 'self':62B 'self-host':61B 'server':66B,77B 'sourc':93B 'sql':65B,76B 'sql-server':64B 'version':104B 'window':67B","search_c":"'allow':113C 'attack':116C 'author':115C 'base':107C 'buffer':108C 'elev':118C 'heap':106C 'heap-bas':105C 'network':122C 'overflow':109C 'privileg':119C 'server':112C 'sql':111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116944","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116944","severity":null,"published_at":"2026-11-10T19:19:27+00:00","modified_at":"2026-11-10T19:19:27+00:00","first_seen_at":"2026-11-10T19:24:47+00:00","fetched_at":"2026-11-10T19:24:47+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116944:3188","url":"https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","severity":null,"published_at":"2026-11-10T23:33:16+00:00","modified_at":"2026-11-10T23:33:16+00:00","first_seen_at":"2026-11-10T23:33:16+00:00","fetched_at":"2026-11-10T23:33:16+00:00","note":"MSRC page not readable via tools; KB5129300 (Microsoft) lists this CVE as fixed in SQL Server 2022 CU27 build 16.0.4315.2; other branch ranges from CNA data via OpenCVE (mirror, not verified). Not exploited, no PoC found.","cites":["https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","https://app.opencve.io/cve/CVE-2026-116944"]}],"documents":[{"id":120312,"url":"https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","title":"KB5129300 SQL Server 2022 CU27 security update, Nov 10 2026","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":120352,"url":"https://app.opencve.io/cve/CVE-2026-116944","title":"OpenCVE: CVE-2026-116944 (CNA affected ranges)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}