{"id":"CVE-2026-94511","kind":"vulnerability","aliases":["CVE-2026-94511"],"related":[],"title":"Microsoft SQL Server: heap overflow lets an authorized user run code remotely","description":"Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.","summary":"A heap-based buffer overflow in Microsoft SQL Server lets an attacker who already has valid access run code over the network. The sources give a CVSS score of 8.8 and no further detail.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["microsoft","sql-server","vendor","windows"],"not_affected_if":["no-sql-server-installed"],"how_to_check":"- Check the SQL Server version with `SELECT @@VERSION` and compare it to the fixed builds in Microsoft's advisory for CVE-2026-94511","fix":null,"status":"open","published_at":"2026-11-10T19:21:36+00:00","first_seen_at":"2026-11-10T19:25:21+00:00","triaged_at":"2026-11-10T19:25:58+00:00","updated_at":"2026-11-10T19:25:58+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-10T19:25:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft SQL Server: heap overflow lets an authorized user run code remotely","impact":"high","summary":"A heap-based buffer overflow in Microsoft SQL Server lets an attacker who already has valid access run code over the network. The sources give a CVSS score of 8.8 and no further detail.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sql-server","windows","microsoft"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker runs code on the database server over the network","analyst_note":"Find Microsoft's advisory for CVE-2026-94511 to confirm affected builds, the fixed build numbers and any required privileges.","how_to_check":"- Check the SQL Server version with `SELECT @@VERSION` and compare it to the fixed builds in Microsoft's advisory for CVE-2026-94511\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-sql-server-installed"],"who_is_affected":"Organisations running Microsoft SQL Server where users hold database credentials that could reach the vulnerable component. The sources do not say which versions or editions are affected, so the exact scope is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000688,"input_tokens":4482,"output_tokens":480,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find Microsoft's advisory for CVE-2026-94511 to confirm affected builds, the fixed build numbers and any required privileges.","search":"'-2026':14A,17A '-94511':15A,18A '8.8':55B 'access':42B 'allow':68C 'alreadi':39B 'attack':37B,71C 'author':8A,70C 'base':28B,62C 'buffer':29B,63C 'code':11A,44B,74C 'cve':13A,16A 'cvss':52B 'detail':59B 'execut':73C 'give':50B 'heap':4A,27B,61C 'heap-bas':26B,60C 'let':6A,35B 'microsoft':1A,19B,32B 'network':47B,77C 'overflow':5A,30B,64C 'remot':12A 'run':10A,43B 'score':53B 'server':3A,22B,34B,67C 'sourc':49B 'sql':2A,21B,33B,66C 'sql-server':20B 'user':9A 'valid':41B 'vendor':23B 'window':24B","nicknames":[],"mitigations":[],"who_affected":"Organisations running Microsoft SQL Server where users hold database credentials that could reach the vulnerable component. The sources do not say which versions or editions are affected, so the exact scope is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","microsoft","sqlserver","vendor","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-94511':15A,18A 'author':8A 'code':11A 'cve':13A,16A 'heap':4A 'let':6A 'microsoft':1A 'overflow':5A 'remot':12A 'run':10A 'server':3A 'sql':2A 'user':9A","search_b":"'8.8':55B 'access':42B 'alreadi':39B 'attack':37B 'base':28B 'buffer':29B 'code':44B 'cvss':52B 'detail':59B 'give':50B 'heap':27B 'heap-bas':26B 'let':35B 'microsoft':19B,32B 'network':47B 'overflow':30B 'run':43B 'score':53B 'server':22B,34B 'sourc':49B 'sql':21B,33B 'sql-server':20B 'valid':41B 'vendor':23B 'window':24B","search_c":"'allow':68C 'attack':71C 'author':70C 'base':62C 'buffer':63C 'code':74C 'execut':73C 'heap':61C 'heap-bas':60C 'network':77C 'overflow':64C 'server':67C 'sql':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94511","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94511","severity":null,"published_at":"2026-11-10T19:21:36+00:00","modified_at":"2026-11-10T19:21:36+00:00","first_seen_at":"2026-11-10T19:25:21+00:00","fetched_at":"2026-11-10T19:25:21+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}