CVE-2026-67630

Microsoft SQL Server Information Disclosure Vulnerability

Published Sep 8, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.

Analysis

Technical impact

The vulnerability is an out-of-bounds read in Microsoft SQL Server that enables an authorized attacker to disclose sensitive information over a network. The flaw is a classic buffer overread, classified as CWE-125, and leads primarily to confidentiality compromise without impacting integrity or availability.

Affected Systems

Affected products include Microsoft SQL Server 2017 (CU 31 and GDR), SQL Server 2019 (CU 32 and GDR), SQL Server 2022 (CU 26 and GDR), and SQL Server 2025 (CU 8 and GDR). These versions are deployed on x64‑based systems.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity. EPSS is currently unavailable and the vulnerability is not listed in CISA’s KEV catalog. The attack vector requires an attacker who is already authorized to access the SQL Server instance, making the exploitation scenario more limited in scope but still significant for internal or privileged users.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Microsoft

Microsoft SQL Server 2017 (CU 31)

affected

Version	Status	Constraints
`14.0.0`	affected	< 14.0.3550.4

Microsoft

Microsoft SQL Server 2017 (GDR)

affected

Version	Status	Constraints
`14.0.0`	affected	< 14.0.2130.4

Microsoft

Microsoft SQL Server 2019 (CU 32)

affected

Version	Status	Constraints
`15.0.0.0`	affected	< 15.0.4490.9

Microsoft

Microsoft SQL Server 2019 (GDR)

affected

Version	Status	Constraints
`15.0.0`	affected	< 15.0.2190.7

Microsoft

Microsoft SQL Server 2022 (CU 26)

affected

Version	Status	Constraints
`16.0.0.0`	affected	< 16.0.4275.2

Microsoft

Microsoft SQL Server 2022 (GDR)

affected

Version	Status	Constraints
`16.0.0`	affected	< 16.0.1200.5

Microsoft

Microsoft SQL Server 2025 (CU8)

affected

Version	Status	Constraints
`17.0.0.0`	affected	< 17.0.4085.5

Microsoft

Microsoft SQL Server 2025 for x64-based Systems (GDR)

affected

Version	Status	Constraints
`17.0.1050.2`	affected	< 17.0.1135.8

Configuration 1 [-]

OR	cpe:2.3:a:microsoft:sql_server_2017:::::::x64:*
	cpe:2.3:a:microsoft:sql_server_2017:::::::x64:*
	cpe:2.3:a:microsoft:sql_server_2019:::::::x64:*
	cpe:2.3:a:microsoft:sql_server_2019:::::::x64:*
	cpe:2.3:a:microsoft:sql_server_2022:::::::x64:*
	cpe:2.3:a:microsoft:sql_server_2022:::::::x64:*
	cpe:2.3:a:microsoft:sql_server_2025:::::::x64:*
	cpe:2.3:a:microsoft:sql_server_2025:::::::x64:*

No data.

Vendor Product Versions

Microsoft

Sql Server 2017

Version	Status	Scheme	Platform
`[14.0.0,14.0.3550.4)`	affected	generic	['x64-based_systems']

Microsoft

Sql Server 2017

Version	Status	Scheme	Platform
`[14.0.0,14.0.2130.4)`	affected	generic	['x64-based_systems']

Microsoft

Sql Server 2019

Version	Status	Scheme	Platform
`[15.0.0.0,15.0.4490.9)`	affected	generic	['x64-based_systems']

Microsoft

Sql Server 2019

Version	Status	Scheme	Platform
`[15.0.0,15.0.2190.7)`	affected	generic	['x64-based_systems']

Microsoft

Sql Server 2022

Version	Status	Scheme	Platform
`[16.0.0.0,16.0.4275.2)`	affected	generic	['x64-based_systems']

Microsoft

Sql Server 2022

Version	Status	Scheme	Platform
`[16.0.0,16.0.1200.5)`	affected	generic	['x64-based_systems']

Microsoft

Sql Server 2025

Version	Status	Scheme	Platform
`[17.0.0.0,17.0.4085.5)`	affected	generic	['x64-based_systems']

Microsoft

Sql Server 2025

Version	Status	Scheme	Platform
`[17.0.1050.2,17.0.1135.8)`	affected	generic	['x64-based_systems']

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Microsoft security update for the affected SQL Server versions to eliminate the out‑of‑bounds read.
Restrict network access to the SQL Server instances by allowing only trusted hosts or subnets and applying strict firewall rules.
Enforce the principle of least privilege for database accounts, removing any unnecessary permissions to reduce the potential impact if an authorized attacker gains access.

Generated by OpenCVE AI on September 8, 2026 at 19:25 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.995% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-67630

History

Oct 2, 2026 6:15 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:microsoft:sql_server_2017:::::::x64:*

Sep 8, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 8, 2026 5:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
Title		Microsoft SQL Server Information Disclosure Vulnerability
First Time appeared		Microsoft Microsoft sql Server 2017 Microsoft sql Server 2019 Microsoft sql Server 2022 Microsoft sql Server 2025
Weaknesses		CWE-125
CPEs		cpe:2.3:a:microsoft:sql_server_2017::-:::::x64: cpe:2.3:a:microsoft:sql_server_2019:::::::x64:* cpe:2.3:a:microsoft:sql_server_2022:::::::x64:* cpe:2.3:a:microsoft:sql_server_2025:::::::x64:*
Vendors & Products		Microsoft Microsoft sql Server 2017 Microsoft sql Server 2019 Microsoft sql Server 2022 Microsoft sql Server 2025
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-67630
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C'}`