---
id: "CVE-2026-67374"
page: "https://infrastack.ai/live/CVE-2026-67374"
kind: "vulnerability"
aliases: ["CVE-2026-67374"]
title: "Microsoft SQL Server: heap overflow lets an authorized user run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "SQL Server 2017 GDR", "fixed": ["14.0.2150.2"], "affected": ">= 14.0.0, < 14.0.2150.2", "ecosystem": "vendor"}, {"name": "SQL Server 2017 CU31", "fixed": ["14.0.3570.2"], "affected": ">= 14.0.3006.16, < 14.0.3570.2", "ecosystem": "vendor"}, {"name": "SQL Server 2019 GDR", "fixed": ["15.0.2210.4"], "affected": ">= 15.0.0, < 15.0.2210.4", "ecosystem": "vendor"}, {"name": "SQL Server 2019 CU32", "fixed": ["15.0.4510.2"], "affected": ">= 15.0.4003.23, < 15.0.4510.2", "ecosystem": "vendor"}, {"name": "SQL Server 2022 GDR", "fixed": ["16.0.1220.3"], "affected": ">= 16.0.0, < 16.0.1220.3", "ecosystem": "vendor"}, {"name": "SQL Server 2022 CU27", "fixed": ["16.0.4315.2"], "affected": ">= 16.0.4003.1, < 16.0.4315.2", "ecosystem": "vendor"}, {"name": "SQL Server 2025 GDR", "fixed": ["17.0.1155.3"], "affected": ">= 17.0.1050.2, < 17.0.1155.3", "ecosystem": "vendor"}, {"name": "SQL Server 2025 CU10", "fixed": ["17.0.5045.3"], "affected": ">= 17.0.4006.0, < 17.0.5045.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["runtime", "self-hosted", "sql-server", "windows"]
not_affected_if: ["no-network-access", "no-untrusted-accounts"]
published_at: "2026-11-10T19:21:17+00:00"
first_seen_at: "2026-11-10T19:25:16+00:00"
updated_at: "2026-11-10T21:22:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67374", "first_seen_at": "2026-11-10T19:25:16+00:00"}, {"source": "analyst", "url": "https://cveawg.mitre.org/api/cve/CVE-2026-67374", "first_seen_at": "2026-11-10T21:22:52+00:00", "cites": ["https://cveawg.mitre.org/api/cve/CVE-2026-67374"]}]
exploit_sources: []
---

# Microsoft SQL Server: heap overflow lets an authorized user run code

Link for people: https://infrastack.ai/live/CVE-2026-67374 (this .md is for agents)

A heap-based buffer overflow in Microsoft SQL Server lets a user who already has authorized access send crafted input over the network. A successful attack can run code on the database server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SQL Server 2017 GDR affected >= 14.0.0, < 14.0.2150.2 fixed 14.0.2150.2
- vendor:SQL Server 2017 CU31 affected >= 14.0.3006.16, < 14.0.3570.2 fixed 14.0.3570.2
- vendor:SQL Server 2019 GDR affected >= 15.0.0, < 15.0.2210.4 fixed 15.0.2210.4
- vendor:SQL Server 2019 CU32 affected >= 15.0.4003.23, < 15.0.4510.2 fixed 15.0.4510.2
- vendor:SQL Server 2022 GDR affected >= 16.0.0, < 16.0.1220.3 fixed 16.0.1220.3
- vendor:SQL Server 2022 CU27 affected >= 16.0.4003.1, < 16.0.4315.2 fixed 16.0.4315.2
- vendor:SQL Server 2025 GDR affected >= 17.0.1050.2, < 17.0.1155.3 fixed 17.0.1155.3
- vendor:SQL Server 2025 CU10 affected >= 17.0.4006.0, < 17.0.5045.3 fixed 17.0.5045.3

## How to check

Run SELECT @@VERSION; (or SELECT SERVERPROPERTY('ProductVersion');) on each instance. You are exposed if the build is in the affected range of your branch (GDR or CU) and below the fixed build listed in the fix field. Use the GDR rows if you only install GDR security updates, and the CU rows if you are on cumulative updates.

## Fix

Update to the first unaffected build for your branch: 2017 GDR 14.0.2150.2, 2017 CU31 14.0.3570.2, 2019 GDR 15.0.2210.4, 2019 CU32 15.0.4510.2, 2022 GDR 16.0.1220.3, 2022 CU27 16.0.4315.2, 2025 GDR 17.0.1155.3, 2025 CU10 17.0.5045.3. Get the matching KB from Microsoft's security update guide entry for CVE-2026-67374.

## Timeline

- 2026-11-10T19:25:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-67374
- 2026-11-10T21:22:52+00:00 analyst https://cveawg.mitre.org/api/cve/CVE-2026-67374 — Read Microsoft's own CVE record (CNA) via cveawg: affected ranges and first-fixed builds per branch. MSRC update-guide page is JS-only and returned nothing, so KB numbers/download links and exploitation status are unconfirmed. Not in Sept KB5122774 list; published 2026-11-10.

## Documents

- [advisory] CVE-2026-67374 CVE record (CNA: Microsoft) https://cveawg.mitre.org/api/cve/CVE-2026-67374

## From the sources

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_