---
id: "CVE-2026-94513"
page: "https://infrastack.ai/live/CVE-2026-94513"
kind: "vulnerability"
aliases: ["CVE-2026-94513"]
title: "Microsoft SQL Server: heap overflow lets a logged-in user gain higher privileges"
severity: "high"
cvss: 8.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["database", "infrastructure", "sql-server", "windows"]
not_affected_if: ["no-network-logins", "non-sql-server"]
published_at: "2026-11-10T19:21:36+00:00"
first_seen_at: "2026-11-10T19:25:21+00:00"
updated_at: "2026-11-10T19:36:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94513", "first_seen_at": "2026-11-10T19:25:21+00:00"}]
exploit_sources: []
---

# Microsoft SQL Server: heap overflow lets a logged-in user gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-94513 (this .md is for agents)

A heap-based buffer overflow in Microsoft SQL Server lets an attacker who already has an account raise their privileges over the network. The sources do not describe the exact exploit path or what data is reachable after escalation.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the SQL Server build with `SELECT @@VERSION` and compare it to the fixed build in Microsoft's advisory.
- Review which accounts can log in to the server and remove unused or overly broad logins.

## Timeline

- 2026-11-10T19:25:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94513

## From the sources

Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_