{"id":"CVE-2026-67372","kind":"vulnerability","aliases":["CVE-2026-67372"],"related":[],"title":"SQL Server: heap buffer overflow lets an authorized user run code","description":"Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.","summary":"A heap-based buffer overflow in Microsoft SQL Server lets an attacker who already has authorized access run code over the network. The sources give a CVSS score of 8.8 and do not name affected or fixed versions.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["runtime","sql-server","windows"],"not_affected_if":["no-network-access","no-untrusted-authorized-users"],"how_to_check":"- Check the installed SQL Server version with `SELECT @@VERSION` and compare it to the vendor's advisory","fix":null,"status":"open","published_at":"2026-11-10T19:21:17+00:00","first_seen_at":"2026-11-10T19:25:16+00:00","triaged_at":"2026-11-10T19:26:13+00:00","updated_at":"2026-11-10T19:26:13+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T19:26:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SQL Server: heap buffer overflow lets an authorized user run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft SQL Server lets an attacker who already has authorized access run code over the network. The sources give a CVSS score of 8.8 and do not name affected or fixed versions.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["sql-server","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker runs code on the database server over the network","analyst_note":"Find the vendor advisory for CVE-2026-67372 to confirm affected SQL Server builds and the fixed cumulative update.","how_to_check":"- Check the installed SQL Server version with `SELECT @@VERSION` and compare it to the vendor's advisory\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-network-access","no-untrusted-authorized-users"],"who_is_affected":"Organizations running Microsoft SQL Server where users hold valid database credentials and the server is reachable over the network. The sources do not list affected versions or configurations. Systems with no network-reachable SQL Server instance and no untrusted authorized users are lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000694,"input_tokens":4482,"output_tokens":491,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the vendor advisory for CVE-2026-67372 to confirm affected SQL Server builds and the fixed cumulative update.","search":"'-2026':13A,16A '-67372':14A,17A '8.8':53B 'access':40B 'affect':58B 'allow':70C 'alreadi':37B 'attack':35B,73C 'author':8A,39B,72C 'base':26B,64C 'buffer':4A,27B,65C 'code':11A,42B,76C 'cve':12A,15A 'cvss':50B 'execut':75C 'fix':60B 'give':48B 'heap':3A,25B,63C 'heap-bas':24B,62C 'let':6A,33B 'microsoft':30B 'name':57B 'network':45B,79C 'overflow':5A,28B,66C 'run':10A,41B 'runtim':18B 'score':51B 'server':2A,21B,32B,69C 'sourc':47B 'sql':1A,20B,31B,68C 'sql-server':19B 'user':9A 'version':61B 'window':22B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Microsoft SQL Server where users hold valid database credentials and the server is reachable over the network. The sources do not list affected versions or configurations. Systems with no network-reachable SQL Server instance and no untrusted authorized users are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","runtime","sqlserver","windows"],"campaign_type":null,"search_a":"'-2026':13A,16A '-67372':14A,17A 'author':8A 'buffer':4A 'code':11A 'cve':12A,15A 'heap':3A 'let':6A 'overflow':5A 'run':10A 'server':2A 'sql':1A 'user':9A","search_b":"'8.8':53B 'access':40B 'affect':58B 'alreadi':37B 'attack':35B 'author':39B 'base':26B 'buffer':27B 'code':42B 'cvss':50B 'fix':60B 'give':48B 'heap':25B 'heap-bas':24B 'let':33B 'microsoft':30B 'name':57B 'network':45B 'overflow':28B 'run':41B 'runtim':18B 'score':51B 'server':21B,32B 'sourc':47B 'sql':20B,31B 'sql-server':19B 'version':61B 'window':22B","search_c":"'allow':70C 'attack':73C 'author':72C 'base':64C 'buffer':65C 'code':76C 'execut':75C 'heap':63C 'heap-bas':62C 'network':79C 'overflow':66C 'server':69C 'sql':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-67372","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67372","severity":null,"published_at":"2026-11-10T19:21:17+00:00","modified_at":"2026-11-10T19:21:17+00:00","first_seen_at":"2026-11-10T19:25:16+00:00","fetched_at":"2026-11-10T19:25:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}