---
id: "CVE-2026-116945"
page: "https://infrastack.ai/live/CVE-2026-116945"
kind: "vulnerability"
aliases: ["CVE-2026-116945"]
title: "Microsoft SQL Server: heap overflow lets unauthenticated network attacker run code"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "SQL Server 2017", "fixed": [], "affected": "unknown builds", "ecosystem": "vendor"}, {"name": "SQL Server 2019", "fixed": [], "affected": "unknown builds", "ecosystem": "vendor"}, {"name": "SQL Server 2022", "fixed": [], "affected": "unknown builds", "ecosystem": "vendor"}, {"name": "SQL Server 2025", "fixed": [], "affected": "unknown builds", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "network", "self-hosted", "sql-server", "unauthenticated", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:19:27+00:00"
first_seen_at: "2026-11-10T19:24:47+00:00"
updated_at: "2026-11-10T19:33:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116945", "first_seen_at": "2026-11-10T19:24:47+00:00"}, {"source": "analyst", "url": "https://vulnipulse.com/vendors/microsoft", "first_seen_at": "2026-11-10T19:33:30+00:00", "cites": ["https://vulnipulse.com/vendors/microsoft", "https://support.microsoft.com/en-us/servicing/sql/kb321185-download-and-install-latest-updates"]}]
exploit_sources: []
---

# Microsoft SQL Server: heap overflow lets unauthenticated network attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-116945 (this .md is for agents)

Microsoft lists a remote code execution flaw in SQL Server (heap-based buffer overflow, CVSS 9.8, network, no authentication or user interaction). A mirror of the MSRC feed names SQL Server 2017, 2019, 2022 and 2025 as affected. Microsoft's own advisory page could not be read, so the exact builds and the fix are unconfirmed. No exploitation or public PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SQL Server 2017 affected unknown builds fixed no fixed version listed
- vendor:SQL Server 2019 affected unknown builds fixed no fixed version listed
- vendor:SQL Server 2022 affected unknown builds fixed no fixed version listed
- vendor:SQL Server 2025 affected unknown builds fixed no fixed version listed

## How to check

Run SELECT SERVERPROPERTY('ProductVersion'), SERVERPROPERTY('ProductLevel') on each instance and compare the build with the Nov 10 2026 security update for your branch in the CVE-2026-116945 MSRC entry. Microsoft's Nov 2026 build list shows GDR builds 17.0.1155.3 (2025), 16.0.1220.3 (2022), 15.0.2210.4 (2019), 14.0.2150.2 (2017) and CU+GDR builds 17.0.5045.3, 16.0.4315.2, 15.0.4510.2, 14.0.3570.2. I could not confirm these fix this CVE.

## Timeline

- 2026-11-10T19:24:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116945
- 2026-11-10T19:33:30+00:00 analyst https://vulnipulse.com/vendors/microsoft — MSRC page not retrievable. A mirror of the MSRC feed (VulniPulse) names SQL Server 2017/2019/2022/2025 as affected. Microsoft's Nov 2026 build table lists new GDR/CU builds, but I found no page tying them to this CVE, so no fix is stated and nothing is verified.

## Documents

- [describes] VulniPulse: Microsoft server advisories (mirror of MSRC feed) https://vulnipulse.com/vendors/microsoft
- [mentions] Latest updates and version history for SQL Server (Microsoft) https://support.microsoft.com/en-us/servicing/sql/kb321185-download-and-install-latest-updates

## From the sources

Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_