---
id: "CVE-2026-94511"
page: "https://infrastack.ai/live/CVE-2026-94511"
kind: "vulnerability"
aliases: ["CVE-2026-94511"]
title: "Microsoft SQL Server: heap overflow lets a logged-in user run code over the network"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "sql-server-2017", "fixed": ["14.0.2150.2", "14.0.3570.2"], "affected": "GDR 14.0.0 to < 14.0.2150.2; CU31 14.0.3006.16 to < 14.0.3570.2", "ecosystem": "vendor"}, {"name": "sql-server-2019", "fixed": ["15.0.2210.4", "15.0.4510.2"], "affected": "GDR 15.0.0 to < 15.0.2210.4; CU32 15.0.4003.23 to < 15.0.4510.2", "ecosystem": "vendor"}, {"name": "sql-server-2022", "fixed": ["16.0.1220.3", "16.0.4315.2"], "affected": "GDR 16.0.0 to < 16.0.1220.3; CU27 16.0.4003.1 to < 16.0.4315.2", "ecosystem": "vendor"}, {"name": "sql-server-2025", "fixed": ["17.0.1155.3", "17.0.5045.3"], "affected": "GDR 17.0.1050.2 to < 17.0.1155.3; CU10 17.0.4006.0 to < 17.0.5045.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authenticated", "microsoft", "self-hosted", "sql-server", "vendor", "windows"]
not_affected_if: ["managed-hosting", "no-sql-server-installed"]
published_at: "2026-11-10T19:21:36+00:00"
first_seen_at: "2026-11-10T19:25:21+00:00"
updated_at: "2026-11-10T20:38:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94511", "first_seen_at": "2026-11-10T19:25:21+00:00"}, {"source": "analyst", "url": "https://cveawg.mitre.org/api/cve/CVE-2026-94511", "first_seen_at": "2026-11-10T20:38:55+00:00", "cites": ["https://cveawg.mitre.org/api/cve/CVE-2026-94511", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-94511"]}]
exploit_sources: []
---

# Microsoft SQL Server: heap overflow lets a logged-in user run code over the network

Link for people: https://infrastack.ai/live/CVE-2026-94511 (this .md is for agents)

Heap-based buffer overflow (CWE-122) in SQL Server 2017, 2019, 2022 and 2025. An attacker with a valid low-privilege login can run code over the network. CVSS 8.8. Microsoft lists fixed builds per branch; no exploitation or public PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:sql-server-2017 affected GDR 14.0.0 to < 14.0.2150.2; CU31 14.0.3006.16 to < 14.0.3570.2 fixed 14.0.2150.2, 14.0.3570.2
- vendor:sql-server-2019 affected GDR 15.0.0 to < 15.0.2210.4; CU32 15.0.4003.23 to < 15.0.4510.2 fixed 15.0.2210.4, 15.0.4510.2
- vendor:sql-server-2022 affected GDR 16.0.0 to < 16.0.1220.3; CU27 16.0.4003.1 to < 16.0.4315.2 fixed 16.0.1220.3, 16.0.4315.2
- vendor:sql-server-2025 affected GDR 17.0.1050.2 to < 17.0.1155.3; CU10 17.0.4006.0 to < 17.0.5045.3 fixed 17.0.1155.3, 17.0.5045.3

## How to check

Run SELECT @@VERSION (or SELECT SERVERPROPERTY('ProductVersion')) and compare with the fixed build for your branch (GDR or CU). Builds below the fixed build, and at or above the branch start (e.g. 2022 CU27 16.0.4003.1 up to below 16.0.4315.2), are affected. Check that the instance's port (default 1433) is not reachable from untrusted networks.

## Fix

Install the SQL Server security update for your branch. Fixed builds: 2017 GDR 14.0.2150.2, 2017 CU31 14.0.3570.2, 2019 GDR 15.0.2210.4, 2019 CU32 15.0.4510.2, 2022 GDR 16.0.1220.3, 2022 CU27 16.0.4315.2, 2025 GDR 17.0.1155.3, 2025 CU10 17.0.5045.3.

## Timeline

- 2026-11-10T19:25:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94511
- 2026-11-10T20:38:55+00:00 analyst https://cveawg.mitre.org/api/cve/CVE-2026-94511 — Microsoft's CNA CVE record (cveawg) lists affected/fixed builds per branch; MSRC page is JS-only and did not render, so build numbers come from the CVE record. No exploitation or PoC found.

## Documents

- [advisory] CVE-2026-94511 CVE record published by Microsoft (CNA) https://cveawg.mitre.org/api/cve/CVE-2026-94511
- [fix] MSRC Security Update Guide CVE-2026-94511 (JS-only, did not render) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-94511

## From the sources

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_