{"id":"CVE-2026-67375","kind":"vulnerability","aliases":["CVE-2026-67375"],"related":[],"title":"Microsoft SQL Server: stack overflow lets an authorized user gain higher privileges","description":"Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.","summary":"A stack-based buffer overflow in Microsoft SQL Server lets an attacker who already has an account raise their privileges over the network. The sources do not describe the exact code path or the privilege reached.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","infrastructure","sql-server","windows"],"not_affected_if":["no-sql-server","no-untrusted-accounts"],"how_to_check":"- Check the installed SQL Server build with `SELECT @@VERSION;` and compare it against Microsoft's security update list","fix":null,"status":"open","published_at":"2026-11-10T19:21:17+00:00","first_seen_at":"2026-11-10T19:25:16+00:00","triaged_at":"2026-11-10T19:26:10+00:00","updated_at":"2026-11-10T19:26:10+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:26:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft SQL Server: stack overflow lets an authorized user gain higher privileges","impact":"high","summary":"A stack-based buffer overflow in Microsoft SQL Server lets an attacker who already has an account raise their privileges over the network. The sources do not describe the exact code path or the privilege reached.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["sql-server","windows","database"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user escalates to higher database privileges over the network","analyst_note":"Read Microsoft's advisory for CVE-2026-67375 to get affected builds, the fixed cumulative update, and any mitigation.","how_to_check":"- Check the installed SQL Server build with `SELECT @@VERSION;` and compare it against Microsoft's security update list\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-sql-server","no-untrusted-accounts"],"who_is_affected":"Organizations running Microsoft SQL Server where some users hold valid accounts, since the attacker must be authenticated first. The sources do not list affected versions, so teams should check their build against Microsoft's advisory. Systems with no SQL Server instances can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000701,"input_tokens":4488,"output_tokens":504,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Read Microsoft's advisory for CVE-2026-67375 to get affected builds, the fixed cumulative update, and any mitigation.","search":"'-2026':14A,17A '-67375':15A,18A 'account':42B 'allow':70C 'alreadi':39B 'attack':37B,73C 'author':8A,72C 'base':28B,64C 'buffer':29B,65C 'code':56B 'cve':13A,16A 'databas':19B 'describ':53B 'elev':75C 'exact':55B 'gain':10A 'higher':11A 'infrastructur':20B 'let':6A,35B 'microsoft':1A,32B 'network':48B,79C 'overflow':5A,30B,66C 'path':57B 'privileg':12A,45B,60B,76C 'rais':43B 'reach':61B 'server':3A,23B,34B,69C 'sourc':50B 'sql':2A,22B,33B,68C 'sql-server':21B 'stack':4A,27B,63C 'stack-bas':26B,62C 'user':9A 'window':24B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Microsoft SQL Server where some users hold valid accounts, since the attacker must be authenticated first. The sources do not list affected versions, so teams should check their build against Microsoft's advisory. Systems with no SQL Server instances can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","infrastructure","sqlserver","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-67375':15A,18A 'author':8A 'cve':13A,16A 'gain':10A 'higher':11A 'let':6A 'microsoft':1A 'overflow':5A 'privileg':12A 'server':3A 'sql':2A 'stack':4A 'user':9A","search_b":"'account':42B 'alreadi':39B 'attack':37B 'base':28B 'buffer':29B 'code':56B 'databas':19B 'describ':53B 'exact':55B 'infrastructur':20B 'let':35B 'microsoft':32B 'network':48B 'overflow':30B 'path':57B 'privileg':45B,60B 'rais':43B 'reach':61B 'server':23B,34B 'sourc':50B 'sql':22B,33B 'sql-server':21B 'stack':27B 'stack-bas':26B 'window':24B","search_c":"'allow':70C 'attack':73C 'author':72C 'base':64C 'buffer':65C 'elev':75C 'network':79C 'overflow':66C 'privileg':76C 'server':69C 'sql':68C 'stack':63C 'stack-bas':62C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-67375","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67375","severity":null,"published_at":"2026-11-10T19:21:17+00:00","modified_at":"2026-11-10T19:21:18+00:00","first_seen_at":"2026-11-10T19:25:16+00:00","fetched_at":"2026-11-10T19:25:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}