---
id: "CVE-2026-67632"
page: "https://infrastack.ai/live/CVE-2026-67632"
kind: "vulnerability"
aliases: ["CVE-2026-67632"]
title: "SQL Server: heap buffer overflow lets an authorized user run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "sql-server-2017-gdr", "fixed": ["14.0.2150.2"], "affected": ">= 14.0.0, < 14.0.2150.2", "ecosystem": "vendor"}, {"name": "sql-server-2017-cu31", "fixed": ["14.0.3570.2"], "affected": ">= 14.0.3006.16, < 14.0.3570.2", "ecosystem": "vendor"}, {"name": "sql-server-2019-gdr", "fixed": ["15.0.2210.4"], "affected": ">= 15.0.0, < 15.0.2210.4", "ecosystem": "vendor"}, {"name": "sql-server-2019-cu32", "fixed": ["15.0.4510.2"], "affected": ">= 15.0.4003.23, < 15.0.4510.2", "ecosystem": "vendor"}, {"name": "sql-server-2022-gdr", "fixed": ["16.0.1220.3"], "affected": ">= 16.0.0, < 16.0.1220.3", "ecosystem": "vendor"}, {"name": "sql-server-2022-cu27", "fixed": ["16.0.4315.2"], "affected": ">= 16.0.4003.1, < 16.0.4315.2", "ecosystem": "vendor"}, {"name": "sql-server-2025-gdr", "fixed": ["17.0.1155.3"], "affected": ">= 17.0.1050.2, < 17.0.1155.3", "ecosystem": "vendor"}, {"name": "sql-server-2025-cu10", "fixed": ["17.0.5045.3"], "affected": ">= 17.0.4006.0, < 17.0.5045.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["runtime", "self-hosted", "sql-server", "windows"]
not_affected_if: ["managed-hosting"]
published_at: "2026-11-10T19:21:19+00:00"
first_seen_at: "2026-11-10T19:25:16+00:00"
updated_at: "2026-11-10T21:16:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67632", "first_seen_at": "2026-11-10T19:25:16+00:00"}, {"source": "analyst", "url": "https://db.gcve.eu/vuln/cve-2026-67632", "first_seen_at": "2026-11-10T21:16:53+00:00", "cites": ["https://db.gcve.eu/vuln/cve-2026-67632"]}]
exploit_sources: []
---

# SQL Server: heap buffer overflow lets an authorized user run code

Link for people: https://infrastack.ai/live/CVE-2026-67632 (this .md is for agents)

Heap-based buffer overflow in Microsoft SQL Server (CWE-122). An authenticated low-privilege user can run code over the network (CVSS 8.8). Microsoft published fixed builds on 2026-11-10 for SQL Server 2017, 2019, 2022 and 2025. No exploitation or public PoC known.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:sql-server-2017-gdr affected >= 14.0.0, < 14.0.2150.2 fixed 14.0.2150.2
- vendor:sql-server-2017-cu31 affected >= 14.0.3006.16, < 14.0.3570.2 fixed 14.0.3570.2
- vendor:sql-server-2019-gdr affected >= 15.0.0, < 15.0.2210.4 fixed 15.0.2210.4
- vendor:sql-server-2019-cu32 affected >= 15.0.4003.23, < 15.0.4510.2 fixed 15.0.4510.2
- vendor:sql-server-2022-gdr affected >= 16.0.0, < 16.0.1220.3 fixed 16.0.1220.3
- vendor:sql-server-2022-cu27 affected >= 16.0.4003.1, < 16.0.4315.2 fixed 16.0.4315.2
- vendor:sql-server-2025-gdr affected >= 17.0.1050.2, < 17.0.1155.3 fixed 17.0.1155.3
- vendor:sql-server-2025-cu10 affected >= 17.0.4006.0, < 17.0.5045.3 fixed 17.0.5045.3

## How to check

Run SELECT @@VERSION (or SERVERPROPERTY('ProductVersion')) and compare with the fixed builds: 2017 GDR 14.0.2150.2, 2017 CU31 14.0.3570.2, 2019 GDR 15.0.2210.4, 2019 CU32 15.0.4510.2, 2022 GDR 16.0.1220.3, 2022 CU27 16.0.4315.2, 2025 GDR 17.0.1155.3, 2025 CU10 17.0.5045.3. Anything lower in its branch is affected.

## Fix

Install the November 2026 SQL Server security update for your branch: 2017 GDR 14.0.2150.2 / CU 14.0.3570.2; 2019 GDR 15.0.2210.4 / CU 15.0.4510.2; 2022 GDR 16.0.1220.3 / CU 16.0.4315.2; 2025 GDR 17.0.1155.3 / CU 17.0.5045.3. Confirm on the MSRC page.

## Timeline

- 2026-11-10T19:25:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-67632
- 2026-11-10T21:16:53+00:00 analyst https://db.gcve.eu/vuln/cve-2026-67632 — MSRC page is JS-only and unreadable; builds taken from Microsoft's CVE record (CNA) via db.gcve.eu mirror. Nothing marked verified. No exploitation or PoC found.

## Documents

- [describes] CVE-2026-67632 (Microsoft CNA CVE record mirror) https://db.gcve.eu/vuln/cve-2026-67632

## From the sources

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_