{"id":"CVE-2026-116947","kind":"vulnerability","aliases":["CVE-2026-116947"],"related":[],"title":"SQL Server: heap buffer overflow lets an authorized user run code","description":"Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.","summary":"A heap-based buffer overflow in Microsoft SQL Server lets an authorized attacker run code over the network. The attacker needs valid credentials for the database first.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"sql-server-2017","fixed":["14.0.2150.2","14.0.3570.2"],"affected":">= 14.0.0, < 14.0.2150.2 (GDR); >= 14.0.3006.16, < 14.0.3570.2 (CU31)","ecosystem":"vendor"},{"name":"sql-server-2019","fixed":["15.0.2210.4","15.0.4510.2"],"affected":">= 15.0.0, < 15.0.2210.4 (GDR); >= 15.0.4003.23, < 15.0.4510.2 (CU32)","ecosystem":"vendor"},{"name":"sql-server-2022","fixed":["16.0.1220.3","16.0.4315.2"],"affected":">= 16.0.0, < 16.0.1220.3 (GDR); >= 16.0.4003.1, < 16.0.4315.2 (CU27)","ecosystem":"vendor"},{"name":"sql-server-2025","fixed":["17.0.1155.3","17.0.5045.3"],"affected":">= 17.0.1050.2, < 17.0.1155.3 (GDR); >= 17.0.4006.0, < 17.0.5045.3 (CU10)","ecosystem":"vendor"}],"ecosystems":[],"tags":["runtime","self-hosted","sql-server","windows"],"not_affected_if":["low-privilege-access-only","no-network-access","no-sql-server"],"how_to_check":"Run SELECT @@VERSION (or SERVERPROPERTY('ProductVersion')) on each instance and compare with the fixed builds for your branch (GDR or CU). Anything lower is affected.","fix":"Update to the November 2026 SQL Server security build for your branch: 2017 GDR 14.0.2150.2, 2017 CU31 14.0.3570.2, 2019 GDR 15.0.2210.4, 2019 CU32 15.0.4510.2, 2022 GDR 16.0.1220.3, 2022 CU27 16.0.4315.2, 2025 GDR 17.0.1155.3, 2025 CU10 17.0.5045.3.","status":"open","published_at":"2026-11-10T19:19:28+00:00","first_seen_at":"2026-11-10T19:24:47+00:00","triaged_at":"2026-11-10T19:44:48+00:00","updated_at":"2026-11-10T23:33:24+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-10T19:44:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SQL Server: heap buffer overflow lets an authorized user run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft SQL Server lets an authorized attacker run code over the network. The attacker needs valid credentials for the database first.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["sql-server","windows","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs code on the database server over the network","analyst_note":"Check Microsoft's MSRC advisory for CVE-2026-116947 for affected SQL Server versions, the fixed builds and any patch or setting.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-network-access","no-sql-server"],"who_is_affected":"Organizations running Microsoft SQL Server that accept network connections from users or applications. The sources do not name affected versions or the specific feature involved, so the exact exposure is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000656,"input_tokens":4482,"output_tokens":416,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Microsoft's MSRC advisory for CVE-2026-116947 for affected SQL Server versions, the fixed builds and any patch or setting.","search":"'-116947':14A,17A '-2026':13A,16A '2017':21A '2019':25A '2022':29A '2025':33A 'allow':78C 'attack':55B,62B,81C 'author':8A,54B,80C 'base':45B,72C 'buffer':4A,46B,73C 'code':11A,57B,84C 'credenti':65B 'cve':12A,15A 'databas':68B 'execut':83C 'first':69B 'heap':3A,44B,71C 'heap-bas':43B,70C 'host':37B 'let':6A,52B 'microsoft':49B 'need':63B 'network':60B,87C 'overflow':5A,47B,74C 'run':10A,56B 'runtim':34B 'self':36B 'self-host':35B 'server':2A,20A,24A,28A,32A,40B,51B,77C 'sql':1A,19A,23A,27A,31A,39B,50B,76C 'sql-server':18A,22A,26A,30A,38B 'user':9A 'valid':64B 'window':41B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Microsoft SQL Server 2017, 2019, 2022 and 2025 instances (Windows) running a build below the November 2026 fixed builds. The attacker needs valid database credentials and the attack is rated high complexity, so instances reachable only by trusted accounts are lower priority. Managed database services are not named in the record.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["sqlserver2017","sqlserver2019","sqlserver2022","sqlserver2025"],"ptokens":["2017","2019","2022","2025","server","sql"],"labels":["high","runtime","selfhosted","sqlserver","windows"],"campaign_type":null,"search_a":"'-116947':14A,17A '-2026':13A,16A '2017':21A '2019':25A '2022':29A '2025':33A 'author':8A 'buffer':4A 'code':11A 'cve':12A,15A 'heap':3A 'let':6A 'overflow':5A 'run':10A 'server':2A,20A,24A,28A,32A 'sql':1A,19A,23A,27A,31A 'sql-server':18A,22A,26A,30A 'user':9A","search_b":"'attack':55B,62B 'author':54B 'base':45B 'buffer':46B 'code':57B 'credenti':65B 'databas':68B 'first':69B 'heap':44B 'heap-bas':43B 'host':37B 'let':52B 'microsoft':49B 'need':63B 'network':60B 'overflow':47B 'run':56B 'runtim':34B 'self':36B 'self-host':35B 'server':40B,51B 'sql':39B,50B 'sql-server':38B 'valid':64B 'window':41B","search_c":"'allow':78C 'attack':81C 'author':80C 'base':72C 'buffer':73C 'code':84C 'execut':83C 'heap':71C 'heap-bas':70C 'network':87C 'overflow':74C 'server':77C 'sql':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116947","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116947","severity":null,"published_at":"2026-11-10T19:19:28+00:00","modified_at":"2026-11-10T19:19:28+00:00","first_seen_at":"2026-11-10T19:24:47+00:00","fetched_at":"2026-11-10T19:24:47+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116947:3186","url":"https://casco.com/cve/CVE-2026-116947","severity":null,"published_at":"2026-11-10T23:33:24+00:00","modified_at":"2026-11-10T23:33:24+00:00","first_seen_at":"2026-11-10T23:33:24+00:00","fetched_at":"2026-11-10T23:33:24+00:00","note":"MSRC page not readable by tools; versions come from the Microsoft-supplied CVE record via a mirror (Casco), so nothing marked verified. Not in exploited/PoC lists. The 2022 CU27 KB5129300 summary I read did not list this CVE, so confirm the KB on MSRC.","cites":["https://casco.com/cve/CVE-2026-116947","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-116947"]}],"documents":[{"id":120355,"url":"https://casco.com/cve/CVE-2026-116947","title":"CVE-2026-116947 (CVE record mirror, Microsoft-supplied version ranges)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":120356,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-116947","title":"MSRC: Microsoft SQL Server Remote Code Execution Vulnerability CVE-2026-116947","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}