{"id":"CVE-2026-116945","kind":"vulnerability","aliases":["CVE-2026-116945"],"related":[],"title":"Microsoft SQL Server: heap overflow lets unauthenticated network attacker run code","description":"Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.","summary":"Microsoft lists a remote code execution flaw in SQL Server (heap-based buffer overflow, CVSS 9.8, network, no authentication or user interaction). A mirror of the MSRC feed names SQL Server 2017, 2019, 2022 and 2025 as affected. Microsoft's own advisory page could not be read, so the exact builds and the fix are unconfirmed. No exploitation or public PoC found.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SQL Server 2017","fixed":[],"affected":"unknown builds","ecosystem":"vendor"},{"name":"SQL Server 2019","fixed":[],"affected":"unknown builds","ecosystem":"vendor"},{"name":"SQL Server 2022","fixed":[],"affected":"unknown builds","ecosystem":"vendor"},{"name":"SQL Server 2025","fixed":[],"affected":"unknown builds","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","network","self-hosted","sql-server","unauthenticated","windows"],"not_affected_if":[],"how_to_check":"Run SELECT SERVERPROPERTY('ProductVersion'), SERVERPROPERTY('ProductLevel') on each instance and compare the build with the Nov 10 2026 security update for your branch in the CVE-2026-116945 MSRC entry. Microsoft's Nov 2026 build list shows GDR builds 17.0.1155.3 (2025), 16.0.1220.3 (2022), 15.0.2210.4 (2019), 14.0.2150.2 (2017) and CU+GDR builds 17.0.5045.3, 16.0.4315.2, 15.0.4510.2, 14.0.3570.2. I could not confirm these fix this CVE.","fix":null,"status":"open","published_at":"2026-11-10T19:19:27+00:00","first_seen_at":"2026-11-10T19:24:47+00:00","triaged_at":"2026-11-10T19:25:43+00:00","updated_at":"2026-11-10T19:33:30+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:25:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft SQL Server: heap overflow lets unauthenticated network attacker run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft SQL Server lets an unauthorized attacker on the network execute code. The sources give a CVSS score of 9.8 and do not describe the affected versions or trigger in detail.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["sql-server","windows","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the database server over the network","analyst_note":"Find Microsoft's advisory for CVE-2026-116945 to get affected SQL Server versions, the fixed builds and any default-config conditions.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Any organization running Microsoft SQL Server that is reachable over the network may be exposed. The sources do not list affected versions or configurations, so the exact scope is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000663,"input_tokens":4487,"output_tokens":428,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Microsoft's advisory for CVE-2026-116945 to get affected SQL Server versions, the fixed builds and any default-config conditions.","search":"'-116945':14A,17A '-2026':13A,16A '2017':20A,72B '2019':23A,73B '2022':26A,74B '2025':29A,76B '9.8':56B 'advisori':82B 'affect':78B 'allow':111C 'attack':9A,114C 'authent':59B 'base':52B,105C 'buffer':53B,106C 'build':91B 'code':11A,44B,117C 'could':84B 'cve':12A,15A 'cvss':55B 'exact':90B 'execut':45B,116C 'exploit':98B 'feed':68B 'fix':94B 'flaw':46B 'found':102B 'heap':4A,51B,104C 'heap-bas':50B,103C 'host':34B 'infrastructur':30B 'interact':62B 'let':6A 'list':41B 'microsoft':1A,40B,79B 'mirror':64B 'msrc':67B 'name':69B 'network':8A,31B,57B,120C 'overflow':5A,54B,107C 'page':83B 'poc':101B 'public':100B 'read':87B 'remot':43B 'run':10A 'self':33B 'self-host':32B 'server':3A,19A,22A,25A,28A,37B,49B,71B,110C 'sql':2A,18A,21A,24A,27A,36B,48B,70B,109C 'sql-server':35B 'unauthent':7A,38B 'unauthor':113C 'unconfirm':96B 'user':61B 'window':39B","nicknames":[],"mitigations":[],"who_affected":"Any self-managed SQL Server 2017, 2019, 2022 or 2025 instance that accepts network connections may be exposed, since the CVSS vector needs no privileges and no user interaction. Prioritise instances reachable from untrusted networks or the internet. Instances not reachable from untrusted networks are lower priority, not safe, until the exact trigger is published.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["server2017","server2019","server2022","server2025","sqlserver2017","sqlserver2019","sqlserver2022","sqlserver2025"],"ptokens":["2017","2019","2022","2025","server","sql"],"labels":["critical","infrastructure","network","selfhosted","sqlserver","unauthenticated","windows"],"campaign_type":null,"search_a":"'-116945':14A,17A '-2026':13A,16A '2017':20A '2019':23A '2022':26A '2025':29A 'attack':9A 'code':11A 'cve':12A,15A 'heap':4A 'let':6A 'microsoft':1A 'network':8A 'overflow':5A 'run':10A 'server':3A,19A,22A,25A,28A 'sql':2A,18A,21A,24A,27A 'unauthent':7A","search_b":"'2017':72B '2019':73B '2022':74B '2025':76B '9.8':56B 'advisori':82B 'affect':78B 'authent':59B 'base':52B 'buffer':53B 'build':91B 'code':44B 'could':84B 'cvss':55B 'exact':90B 'execut':45B 'exploit':98B 'feed':68B 'fix':94B 'flaw':46B 'found':102B 'heap':51B 'heap-bas':50B 'host':34B 'infrastructur':30B 'interact':62B 'list':41B 'microsoft':40B,79B 'mirror':64B 'msrc':67B 'name':69B 'network':31B,57B 'overflow':54B 'page':83B 'poc':101B 'public':100B 'read':87B 'remot':43B 'self':33B 'self-host':32B 'server':37B,49B,71B 'sql':36B,48B,70B 'sql-server':35B 'unauthent':38B 'unconfirm':96B 'user':61B 'window':39B","search_c":"'allow':111C 'attack':114C 'base':105C 'buffer':106C 'code':117C 'execut':116C 'heap':104C 'heap-bas':103C 'network':120C 'overflow':107C 'server':110C 'sql':109C 'unauthor':113C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116945","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116945","severity":null,"published_at":"2026-11-10T19:19:27+00:00","modified_at":"2026-11-10T19:19:27+00:00","first_seen_at":"2026-11-10T19:24:47+00:00","fetched_at":"2026-11-10T19:24:47+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116945:2521","url":"https://vulnipulse.com/vendors/microsoft","severity":null,"published_at":"2026-11-10T19:33:30+00:00","modified_at":"2026-11-10T19:33:30+00:00","first_seen_at":"2026-11-10T19:33:30+00:00","fetched_at":"2026-11-10T19:33:30+00:00","note":"MSRC page not retrievable. A mirror of the MSRC feed (VulniPulse) names SQL Server 2017/2019/2022/2025 as affected. Microsoft's Nov 2026 build table lists new GDR/CU builds, but I found no page tying them to this CVE, so no fix is stated and nothing is verified.","cites":["https://vulnipulse.com/vendors/microsoft","https://support.microsoft.com/en-us/servicing/sql/kb321185-download-and-install-latest-updates"]}],"documents":[{"id":117575,"url":"https://vulnipulse.com/vendors/microsoft","title":"VulniPulse: Microsoft server advisories (mirror of MSRC feed)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":117576,"url":"https://support.microsoft.com/en-us/servicing/sql/kb321185-download-and-install-latest-updates","title":"Latest updates and version history for SQL Server","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}