{"id":"CVE-2026-94513","kind":"vulnerability","aliases":["CVE-2026-94513"],"related":[],"title":"Microsoft SQL Server: heap overflow lets a logged-in user gain higher privileges","description":"Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.","summary":"A heap-based buffer overflow in Microsoft SQL Server lets an attacker who already has an account raise their privileges over the network. The sources do not describe the exact exploit path or what data is reachable after escalation.","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","infrastructure","sql-server","windows"],"not_affected_if":["no-network-logins","non-sql-server"],"how_to_check":"- Check the SQL Server build with `SELECT @@VERSION` and compare it to the fixed build in Microsoft's advisory.\n- Review which accounts can log in to the server and remove unused or overly broad logins.","fix":null,"status":"open","published_at":"2026-11-10T19:21:36+00:00","first_seen_at":"2026-11-10T19:25:21+00:00","triaged_at":"2026-11-10T19:36:03+00:00","updated_at":"2026-11-10T19:36:03+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:36:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft SQL Server: heap overflow lets a logged-in user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in Microsoft SQL Server lets an attacker who already has an account raise their privileges over the network. The sources do not describe the exact exploit path or what data is reachable after escalation.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["sql-server","windows","database"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"low-privileged account gains elevated database or host privileges","analyst_note":"Find the affected and fixed SQL Server builds in the Microsoft Security Response Center entry for CVE-2026-94513 and confirm the exploit prerequisites.","how_to_check":"- Check the SQL Server build with `SELECT @@VERSION` and compare it to the fixed build in Microsoft's advisory.\n- Review which accounts can log in to the server and remove unused or overly broad logins.","plain_action":"","product_name":"Microsoft SQL Server","needs_analyst":true,"not_affected_if":["no-network-logins","non-sql-server"],"who_is_affected":"Any organization running a Microsoft SQL Server instance that accepts network connections from authenticated users may be exposed. Servers where only fully trusted administrators can log in are at lower practical risk. The sources do not list affected builds.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000728,"input_tokens":4488,"output_tokens":559,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the affected and fixed SQL Server builds in the Microsoft Security Response Center entry for CVE-2026-94513 and confirm the exploit prerequisites.","search":"'-2026':16A,19A '-94513':17A,20A 'account':44B 'allow':75C 'alreadi':41B 'attack':39B,78C 'author':77C 'base':30B,69C 'buffer':31B,70C 'cve':15A,18A 'data':62B 'databas':21B 'describ':55B 'elev':80C 'escal':66B 'exact':57B 'exploit':58B 'gain':12A 'heap':4A,29B,68C 'heap-bas':28B,67C 'higher':13A 'infrastructur':22B 'let':6A,37B 'log':9A 'logged-in':8A 'microsoft':1A,34B 'network':50B,84C 'overflow':5A,32B,71C 'path':59B 'privileg':14A,47B,81C 'rais':45B 'reachabl':64B 'server':3A,25B,36B,74C 'sourc':52B 'sql':2A,24B,35B,73C 'sql-server':23B 'user':11A 'window':26B","nicknames":[],"mitigations":[],"who_affected":"Any organization running a Microsoft SQL Server instance that accepts network connections from authenticated users may be exposed. Servers where only fully trusted administrators can log in are at lower practical risk. The sources do not list affected builds.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","infrastructure","sqlserver","windows"],"campaign_type":null,"search_a":"'-2026':16A,19A '-94513':17A,20A 'cve':15A,18A 'gain':12A 'heap':4A 'higher':13A 'let':6A 'log':9A 'logged-in':8A 'microsoft':1A 'overflow':5A 'privileg':14A 'server':3A 'sql':2A 'user':11A","search_b":"'account':44B 'alreadi':41B 'attack':39B 'base':30B 'buffer':31B 'data':62B 'databas':21B 'describ':55B 'escal':66B 'exact':57B 'exploit':58B 'heap':29B 'heap-bas':28B 'infrastructur':22B 'let':37B 'microsoft':34B 'network':50B 'overflow':32B 'path':59B 'privileg':47B 'rais':45B 'reachabl':64B 'server':25B,36B 'sourc':52B 'sql':24B,35B 'sql-server':23B 'window':26B","search_c":"'allow':75C 'attack':78C 'author':77C 'base':69C 'buffer':70C 'elev':80C 'heap':68C 'heap-bas':67C 'network':84C 'overflow':71C 'privileg':81C 'server':74C 'sql':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94513","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94513","severity":null,"published_at":"2026-11-10T19:21:36+00:00","modified_at":"2026-11-10T19:21:37+00:00","first_seen_at":"2026-11-10T19:25:21+00:00","fetched_at":"2026-11-10T19:25:21+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}