---
id: "CVE-2026-67387"
page: "https://infrastack.ai/live/CVE-2026-67387"
kind: "vulnerability"
aliases: ["CVE-2026-67387"]
title: "SQL Server: untrusted pointer dereference lets an authorized user gain higher privileges"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "SQL Server 2025", "fixed": ["17.0.1155.3", "17.0.5045.3"], "affected": ">= 17.0.1000.7, < 17.0.1155.3 (RTM GDR); >= 17.0.4006.2, < 17.0.5045.3 (CU10)", "ecosystem": "microsoft"}, {"name": "SQL Server 2022", "fixed": ["16.0.1220.3", "16.0.4315.2"], "affected": ">= 16.0.1000.6, < 16.0.1220.3 (RTM GDR); >= 16.0.4003.1, < 16.0.4315.2 (CU27)", "ecosystem": "microsoft"}, {"name": "SQL Server 2019", "fixed": ["15.0.2210.4", "15.0.4510.2"], "affected": ">= 15.0.2000.5, < 15.0.2210.4 (RTM GDR); >= 15.0.4003.23, < 15.0.4510.2 (CU32)", "ecosystem": "microsoft"}, {"name": "SQL Server 2017", "fixed": ["14.0.2150.2", "14.0.3570.2"], "affected": ">= 14.0.1000.169, < 14.0.2150.2 (RTM GDR); >= 14.0.3006.16, < 14.0.3570.2 (CU31)", "ecosystem": "microsoft"}]
ecosystems: []
tags: ["microsoft", "other", "privilege-escalation", "self-hosted", "sql-server"]
not_affected_if: ["managed-hosting"]
published_at: "2026-11-10T19:21:18+00:00"
first_seen_at: "2026-11-10T19:25:16+00:00"
updated_at: "2026-11-10T21:19:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67387", "first_seen_at": "2026-11-10T19:25:16+00:00"}, {"source": "analyst", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-67387", "first_seen_at": "2026-11-10T21:19:07+00:00", "cites": ["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-67387"]}]
exploit_sources: []
---

# SQL Server: untrusted pointer dereference lets an authorized user gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-67387 (this .md is for agents)

An authenticated SQL Server user with explicit permissions can log in and escalate to sysadmin through an untrusted pointer dereference (CWE-822). CVSS 8.8. Microsoft rates it Important, Exploitation Less Likely, not publicly disclosed and not exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- microsoft:SQL Server 2025 affected >= 17.0.1000.7, < 17.0.1155.3 (RTM GDR); >= 17.0.4006.2, < 17.0.5045.3 (CU10) fixed 17.0.1155.3, 17.0.5045.3
- microsoft:SQL Server 2022 affected >= 16.0.1000.6, < 16.0.1220.3 (RTM GDR); >= 16.0.4003.1, < 16.0.4315.2 (CU27) fixed 16.0.1220.3, 16.0.4315.2
- microsoft:SQL Server 2019 affected >= 15.0.2000.5, < 15.0.2210.4 (RTM GDR); >= 15.0.4003.23, < 15.0.4510.2 (CU32) fixed 15.0.2210.4, 15.0.4510.2
- microsoft:SQL Server 2017 affected >= 14.0.1000.169, < 14.0.2150.2 (RTM GDR); >= 14.0.3006.16, < 14.0.3570.2 (CU31) fixed 14.0.2150.2, 14.0.3570.2

## How to check

Run SELECT @@VERSION (or SERVERPROPERTY('ProductVersion')) and find your build in the ranges in Microsoft's advisory table; if it is below the fixed build for its branch, you are exposed. Ranges: 2025 CU10 17.0.4006.2-17.0.5035.5, 2025 RTM 17.0.1000.7-17.0.1145.4, 2022 CU27 16.0.4003.1-16.0.4305.5, 2022 RTM 16.0.1000.6-16.0.1210.3, 2019 CU32 15.0.4003.23-15.0.4500.2, 2019 RTM 15.0.2000.5-15.0.2200.2, 2017 CU31 14.0.3006.16-14.0.3560.2, 2017 RTM 14.0.1000.169-14.0.2140.2.

## Fix

Install the November 2026 GDR for your branch: 2025 CU10 -> 17.0.5045.3 (KB5129299); 2025 RTM GDR -> 17.0.1155.3 (KB5132748); 2022 CU27 -> 16.0.4315.2 (KB5129300); 2022 RTM GDR -> 16.0.1220.3 (KB5132747); 2019 CU32 -> 15.0.4510.2 (KB5132745); 2019 RTM GDR -> 15.0.2210.4 (KB5132751); 2017 CU31 -> 14.0.3570.2 (KB5132746); 2017 RTM GDR -> 14.0.2150.2 (KB5132749).

## Timeline

- 2026-11-10T19:25:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-67387
- 2026-11-10T21:19:07+00:00 analyst https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-67387 — Read MSRC data (api.msrc.microsoft.com sug endpoint; the update-guide page is JS-only). Not exploited, not disclosed, Exploitation Less Likely.

## Documents

- [advisory] MSRC: CVE-2026-67387 SQL Server Elevation of Privilege https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-67387

## From the sources

Untrusted pointer dereference in SQL Server allows an authorized attacker to elevate privileges over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_