{"id":"CVE-2026-67646","kind":"vulnerability","aliases":["CVE-2026-67646"],"related":[],"title":"Microsoft SQL Server: heap overflow lets an authorized user run code remotely","description":"Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.","summary":"A heap-based buffer overflow in Microsoft SQL Server lets a logged-in attacker overwrite memory over the network. The sources say this can lead to code execution.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","sql-server","vendor","windows"],"not_affected_if":["no-authorized-accounts","no-network-access"],"how_to_check":"- Check the SQL Server version with `SELECT @@VERSION` and compare it with the fixed builds in Microsoft's advisory for CVE-2026-67646.","fix":null,"status":"open","published_at":"2026-11-10T19:21:19+00:00","first_seen_at":"2026-11-10T19:25:16+00:00","triaged_at":"2026-11-10T19:26:06+00:00","updated_at":"2026-11-10T19:26:06+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T19:26:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft SQL Server: heap overflow lets an authorized user run code remotely","impact":"high","summary":"A heap-based buffer overflow in Microsoft SQL Server lets a logged-in attacker overwrite memory over the network. The sources say this can lead to code execution.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sql-server","windows","database"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs code on the database server over the network","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-67646 to confirm affected builds and fixed versions.","how_to_check":"- Check the SQL Server version with `SELECT @@VERSION` and compare it with the fixed builds in Microsoft's advisory for CVE-2026-67646.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-network-access","no-authorized-accounts"],"who_is_affected":"Organizations running Microsoft SQL Server where attackers hold valid accounts that can reach the server over the network. The sources do not list affected versions. unknown for whether default configurations are exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000686,"input_tokens":4482,"output_tokens":475,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-67646 to confirm affected builds and fixed versions.","search":"'-2026':14A,17A '-67646':15A,18A 'allow':63C 'attack':40B,66C 'author':8A,65C 'base':28B,57C 'buffer':29B,58C 'code':11A,53B,69C 'cve':13A,16A 'databas':19B 'execut':54B,68C 'heap':4A,27B,56C 'heap-bas':26B,55C 'lead':51B 'let':6A,35B 'log':38B 'logged-in':37B 'memori':42B 'microsoft':1A,32B 'network':45B,72C 'overflow':5A,30B,59C 'overwrit':41B 'remot':12A 'run':10A 'say':48B 'server':3A,22B,34B,62C 'sourc':47B 'sql':2A,21B,33B,61C 'sql-server':20B 'user':9A 'vendor':23B 'window':24B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Microsoft SQL Server where attackers hold valid accounts that can reach the server over the network. The sources do not list affected versions. unknown for whether default configurations are exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","sqlserver","vendor","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-67646':15A,18A 'author':8A 'code':11A 'cve':13A,16A 'heap':4A 'let':6A 'microsoft':1A 'overflow':5A 'remot':12A 'run':10A 'server':3A 'sql':2A 'user':9A","search_b":"'attack':40B 'base':28B 'buffer':29B 'code':53B 'databas':19B 'execut':54B 'heap':27B 'heap-bas':26B 'lead':51B 'let':35B 'log':38B 'logged-in':37B 'memori':42B 'microsoft':32B 'network':45B 'overflow':30B 'overwrit':41B 'say':48B 'server':22B,34B 'sourc':47B 'sql':21B,33B 'sql-server':20B 'vendor':23B 'window':24B","search_c":"'allow':63C 'attack':66C 'author':65C 'base':57C 'buffer':58C 'code':69C 'execut':68C 'heap':56C 'heap-bas':55C 'network':72C 'overflow':59C 'server':62C 'sql':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-67646","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67646","severity":null,"published_at":"2026-11-10T19:21:19+00:00","modified_at":"2026-11-10T19:21:19+00:00","first_seen_at":"2026-11-10T19:25:16+00:00","fetched_at":"2026-11-10T19:25:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}