---
id: "CVE-2026-67372"
page: "https://infrastack.ai/live/CVE-2026-67372"
kind: "vulnerability"
aliases: ["CVE-2026-67372"]
title: "SQL Server: heap buffer overflow lets a signed-in user run code over the network"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["auth-required", "runtime", "sql-server", "windows"]
not_affected_if: ["no-network-access", "no-untrusted-authorized-users"]
published_at: "2026-11-10T19:21:17+00:00"
first_seen_at: "2026-11-10T19:25:16+00:00"
updated_at: "2026-11-10T21:22:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67372", "first_seen_at": "2026-11-10T19:25:16+00:00"}, {"source": "analyst", "url": "https://tri.opswat.com/vulnerabilities/CVE-2026-67372", "first_seen_at": "2026-11-10T21:22:31+00:00", "cites": ["https://tri.opswat.com/vulnerabilities/CVE-2026-67372"]}]
exploit_sources: []
---

# SQL Server: heap buffer overflow lets a signed-in user run code over the network

Link for people: https://infrastack.ai/live/CVE-2026-67372 (this .md is for agents)

Microsoft lists CVE-2026-67372 as a SQL Server remote code execution flaw (heap-based buffer overflow, CWE-122, CVSS 3.1 8.8: network, low privileges, no user interaction). An attacker needs a valid login first. I could not read Microsoft's advisory (the MSRC page needs JavaScript), so affected builds and the fixed update are not confirmed. An aggregator lists SQL Server 2025 (GDR and CU10) among affected products. No exploitation or public proof of concept found.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Run SELECT @@VERSION and compare the build with the fixed build in the MSRC page for CVE-2026-67372. The September 2026 KB5122772 (SQL Server 2019 CU32 GDR, build 15.0.4490.9) does not list this CVE, so do not assume it fixes it. Also check SQL Server 2025 instances.

## Timeline

- 2026-11-10T19:25:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-67372
- 2026-11-10T21:22:31+00:00 analyst https://tri.opswat.com/vulnerabilities/CVE-2026-67372 — MSRC page is JS-only and returned nothing; NVD gave nothing. Only an aggregator (OPSWAT) confirms the description, CVSS 8.8 and SQL Server 2025 GDR/CU10 listing. KB5122772 (2019) does not list this CVE. Fixed version unknown; need MSRC/KB page for the November 2026 SQL Server update. Nothing verified.

## Documents

- [mentions] CVE-2026-67372 - MetaDefender Tri (aggregator) https://tri.opswat.com/vulnerabilities/CVE-2026-67372

## From the sources

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_