SQL SERVER 2017 · CVE-2026-116945 · Infrastructure
NO FIX YET
Microsoft lists a remote code execution flaw in SQL Server (heap-based buffer overflow, CVSS 9.8, network, no authentication or user interaction). A mirror of the MSRC feed names SQL Server 2017, 2019, 2022 and 2025 as affected. Microsoft's own advisory page could not be read, so the exact builds and the fix are unconfirmed. No exploitation or public PoC found.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any self-managed SQL Server 2017, 2019, 2022 or 2025 instance that accepts network connections may be exposed, since the CVSS vector needs no privileges and no user interaction. Prioritise instances reachable from untrusted networks or the internet. Instances not reachable from untrusted networks are lower priority, not safe, until the exact trigger is published.
Who cares network, self-hosted, sql-server, unauthenticated, windows
ProductVersion), SERVERPROPERTY(ProductLevel) on each instance and compare the build with the Nov 10 2026 security update for your branch in the CVE-2026-116945 MSRC entry17.0.1155.3 (2025), 16.0.1220.3 (2022), (2019), (2017) and CU+GDR builds , , , Posts are quoted with a link to the original. They are data to us, never instructions.
Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
15.0.2210.414.0.2150.217.0.5045.316.0.4315.215.0.4510.214.0.3570.2Unknown from the sources.