{"id":"CVE-2026-116946","kind":"vulnerability","aliases":["CVE-2026-116946"],"related":[],"title":"Microsoft SQL Server: heap overflow lets an authorized user run code","description":"Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.","summary":"A heap-based buffer overflow in Microsoft SQL Server lets an attacker who already holds valid credentials trigger memory corruption over the network. The sources describe code execution as the result.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"sql-server-2022","fixed":["16.0.4315.2","16.0.1220.3"],"affected":">= 16.0.4003.1, < 16.0.4315.2 (CU27); >= 16.0.0, < 16.0.1220.3 (GDR)","ecosystem":"vendor"},{"name":"sql-server-2019","fixed":["15.0.4510.2","15.0.2210.4"],"affected":">= 15.0.4003.23, < 15.0.4510.2 (CU32); >= 15.0.0, < 15.0.2210.4 (GDR)","ecosystem":"vendor"},{"name":"sql-server-2017","fixed":["14.0.3570.2","14.0.2150.2"],"affected":">= 14.0.3006.16, < 14.0.3570.2 (CU31); >= 14.0.0, < 14.0.2150.2 (GDR)","ecosystem":"vendor"},{"name":"sql-server-2025","fixed":["17.0.5045.3","17.0.1155.3"],"affected":">= 17.0.4006.0, < 17.0.5045.3 (CU10); >= 17.0.1050.2, < 17.0.1155.3 (GDR)","ecosystem":"vendor"}],"ecosystems":[],"tags":["linux","microsoft","self-hosted","sql-server","vendor","windows"],"not_affected_if":["auth-required","managed-hosting","unknown"],"how_to_check":"Run SELECT @@VERSION (or SERVERPROPERTY('ProductVersion')) on each instance. You are exposed if the build is below the fixed build for your branch: 2017 GDR <14.0.2150.2, 2017 CU31 <14.0.3570.2, 2019 GDR <15.0.2210.4, 2019 CU32 <15.0.4510.2, 2022 GDR <16.0.1220.3, 2022 CU27 <16.0.4315.2, 2025 CU10 <17.0.5045.3, 2025 GDR <17.0.1155.3. Also check any Linux instances.","fix":"Install the Nov 10 2026 security update for your branch. Confirmed on Microsoft's page: SQL Server 2022 CU27 branch to 16.0.4315.2 (KB5129300). From CNA data, not yet checked against each KB: 2017 GDR 14.0.2150.2, 2017 CU31 14.0.3570.2, 2019 GDR 15.0.2210.4, 2019 CU32 15.0.4510.2, 2022 GDR 16.0.1220.3, 2025 CU10 17.0.5045.3, 2025 GDR 17.0.1155.3. Microsoft also advises enabling encryption with Extended Protection.","status":"open","published_at":"2026-11-10T19:19:27+00:00","first_seen_at":"2026-11-10T19:24:47+00:00","triaged_at":"2026-11-10T19:30:22+00:00","updated_at":"2026-11-10T23:33:06+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-11-10T19:30:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft SQL Server: heap overflow lets an authorized user run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft SQL Server lets an attacker who already holds valid credentials trigger memory corruption over the network. The sources describe code execution as the result.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sql-server","microsoft","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"code runs on the database server","analyst_note":"Check Microsoft's security update guide for CVE-2026-116946 for affected versions and the patch.","how_to_check":"- Check the SQL Server version and cumulative update level with `SELECT @@VERSION` against Microsoft's product ranges, which the sources do not list\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running Microsoft SQL Server where some users hold valid database accounts and the server is reachable over the network. The sources do not list affected versions or configuration details. Installations without network exposure to untrusted authenticated users are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000679,"input_tokens":4482,"output_tokens":461,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Microsoft's security update guide for CVE-2026-116946 for affected versions and the patch.","search":"'-116946':14A,17A '-2026':13A,16A '2017':29A '2019':25A '2022':21A '2025':33A 'allow':84C 'alreadi':58B 'attack':56B,87C 'author':8A,86C 'base':47B,78C 'buffer':48B,79C 'code':11A,71B,90C 'corrupt':64B 'credenti':61B 'cve':12A,15A 'describ':70B 'execut':72B,89C 'heap':4A,46B,77C 'heap-bas':45B,76C 'hold':59B 'host':38B 'let':6A,54B 'linux':34B 'memori':63B 'microsoft':1A,35B,51B 'network':67B,93C 'overflow':5A,49B,80C 'result':75B 'run':10A 'self':37B 'self-host':36B 'server':3A,20A,24A,28A,32A,41B,53B,83C 'sourc':69B 'sql':2A,19A,23A,27A,31A,40B,52B,82C 'sql-server':18A,22A,26A,30A,39B 'trigger':62B 'user':9A 'valid':60B 'vendor':42B 'window':43B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed SQL Server 2017, 2019, 2022 or 2025 where untrusted or low-privilege logins can reach the database port. The attacker needs valid credentials (PR:L) but no user interaction. Teams on managed database services that Microsoft patches, or with no SQL Server, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["sqlserver2017","sqlserver2019","sqlserver2022","sqlserver2025"],"ptokens":["2017","2019","2022","2025","server","sql"],"labels":["high","linux","microsoft","selfhosted","sqlserver","vendor","windows"],"campaign_type":null,"search_a":"'-116946':14A,17A '-2026':13A,16A '2017':29A '2019':25A '2022':21A '2025':33A 'author':8A 'code':11A 'cve':12A,15A 'heap':4A 'let':6A 'microsoft':1A 'overflow':5A 'run':10A 'server':3A,20A,24A,28A,32A 'sql':2A,19A,23A,27A,31A 'sql-server':18A,22A,26A,30A 'user':9A","search_b":"'alreadi':58B 'attack':56B 'base':47B 'buffer':48B 'code':71B 'corrupt':64B 'credenti':61B 'describ':70B 'execut':72B 'heap':46B 'heap-bas':45B 'hold':59B 'host':38B 'let':54B 'linux':34B 'memori':63B 'microsoft':35B,51B 'network':67B 'overflow':49B 'result':75B 'self':37B 'self-host':36B 'server':41B,53B 'sourc':69B 'sql':40B,52B 'sql-server':39B 'trigger':62B 'valid':60B 'vendor':42B 'window':43B","search_c":"'allow':84C 'attack':87C 'author':86C 'base':78C 'buffer':79C 'code':90C 'execut':89C 'heap':77C 'heap-bas':76C 'network':93C 'overflow':80C 'server':83C 'sql':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116946","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116946","severity":null,"published_at":"2026-11-10T19:19:27+00:00","modified_at":"2026-11-10T19:19:28+00:00","first_seen_at":"2026-11-10T19:24:47+00:00","fetched_at":"2026-11-10T19:24:47+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116946:3187","url":"https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","severity":null,"published_at":"2026-11-10T23:33:06+00:00","modified_at":"2026-11-10T23:33:06+00:00","first_seen_at":"2026-11-10T23:33:06+00:00","fetched_at":"2026-11-10T23:33:06+00:00","note":"Microsoft's KB5129300 (SQL Server 2022 CU27, 16.0.4315.2) lists this CVE as Remote Code Execution. Other branch ranges come from the Microsoft CNA record via OpenCVE; I did not read those KBs, so nothing is marked verified. No exploitation or PoC found.","cites":["https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","https://app.opencve.io/cve/CVE-2026-116946"]}],"documents":[{"id":120312,"url":"https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","title":"KB5129300 SQL Server 2022 CU27 security update, Nov 10 2026","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":120350,"url":"https://app.opencve.io/cve/CVE-2026-116946","title":"OpenCVE CVE-2026-116946 (Microsoft CNA affected ranges)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}