{"id":"CVE-2026-67391","kind":"vulnerability","aliases":["CVE-2026-67391"],"related":[],"title":"Microsoft SQL Server: heap overflow lets an authorized user run code","description":"Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.","summary":"A heap-based buffer overflow in Microsoft SQL Server lets a user who already has access run code over the network. The attacker gets code execution on the database server if the flaw is exploited.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["microsoft","sql-server","vendor","windows"],"not_affected_if":["auth-required","no-sql-server-installed"],"how_to_check":"- Check the installed SQL Server build with `SELECT @@VERSION` and compare it with the fixed builds in Microsoft's advisory, which the sources do not list","fix":null,"status":"open","published_at":"2026-11-10T19:21:18+00:00","first_seen_at":"2026-11-10T19:25:16+00:00","triaged_at":"2026-11-10T19:26:09+00:00","updated_at":"2026-11-10T19:26:09+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-10T19:26:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft SQL Server: heap overflow lets an authorized user run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft SQL Server lets a user who already has access run code over the network. The attacker gets code execution on the database server if the flaw is exploited.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sql-server","microsoft","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"code runs on the database server over the network","analyst_note":"Find the affected SQL Server builds and fixed versions in Microsoft's security update guide entry for CVE-2026-67391.","how_to_check":"- Check the installed SQL Server build with `SELECT @@VERSION` and compare it with the fixed builds in Microsoft's advisory, which the sources do not list\n- unknown otherwise","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-sql-server-installed","auth-required"],"who_is_affected":"Organizations running Microsoft SQL Server where attackers already hold valid credentials or accounts that can reach the server over the network. The sources do not name affected builds or fixed versions, so the exact exposure is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00069,"input_tokens":4482,"output_tokens":484,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the affected SQL Server builds and fixed versions in Microsoft's security update guide entry for CVE-2026-67391.","search":"'-2026':13A,16A '-67391':14A,17A 'access':40B 'allow':68C 'alreadi':38B 'attack':47B,71C 'author':8A,70C 'base':27B,62C 'buffer':28B,63C 'code':11A,42B,49B,74C 'cve':12A,15A 'databas':53B 'execut':50B,73C 'exploit':59B 'flaw':57B 'get':48B 'heap':4A,26B,61C 'heap-bas':25B,60C 'let':6A,34B 'microsoft':1A,18B,31B 'network':45B,77C 'overflow':5A,29B,64C 'run':10A,41B 'server':3A,21B,33B,54B,67C 'sql':2A,20B,32B,66C 'sql-server':19B 'user':9A,36B 'vendor':22B 'window':23B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Microsoft SQL Server where attackers already hold valid credentials or accounts that can reach the server over the network. The sources do not name affected builds or fixed versions, so the exact exposure is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","microsoft","sqlserver","vendor","windows"],"campaign_type":null,"search_a":"'-2026':13A,16A '-67391':14A,17A 'author':8A 'code':11A 'cve':12A,15A 'heap':4A 'let':6A 'microsoft':1A 'overflow':5A 'run':10A 'server':3A 'sql':2A 'user':9A","search_b":"'access':40B 'alreadi':38B 'attack':47B 'base':27B 'buffer':28B 'code':42B,49B 'databas':53B 'execut':50B 'exploit':59B 'flaw':57B 'get':48B 'heap':26B 'heap-bas':25B 'let':34B 'microsoft':18B,31B 'network':45B 'overflow':29B 'run':41B 'server':21B,33B,54B 'sql':20B,32B 'sql-server':19B 'user':36B 'vendor':22B 'window':23B","search_c":"'allow':68C 'attack':71C 'author':70C 'base':62C 'buffer':63C 'code':74C 'execut':73C 'heap':61C 'heap-bas':60C 'network':77C 'overflow':64C 'server':67C 'sql':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-67391","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67391","severity":null,"published_at":"2026-11-10T19:21:18+00:00","modified_at":"2026-11-10T19:21:18+00:00","first_seen_at":"2026-11-10T19:25:16+00:00","fetched_at":"2026-11-10T19:25:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}