CVE-2026-67384: SQL Server RCE Vulnerability

CVE-2026-67384 Overview

CVE-2026-67384 is an integer overflow vulnerability in Microsoft SQL Server that allows an authenticated attacker to execute arbitrary code over a network. The flaw is classified under CWE-122, heap-based buffer overflow, indicating that the integer wraparound leads to undersized heap allocations and subsequent memory corruption. Successful exploitation grants attackers the ability to run code in the context of the SQL Server process, compromising confidentiality, integrity, and availability of the database instance.

Critical Impact
An authenticated attacker with low privileges can trigger heap corruption and execute arbitrary code remotely against a vulnerable SQL Server instance without user interaction.

Affected Products

Microsoft SQL Server (specific supported versions per Microsoft advisory)
Deployments exposing the SQL Server TDS endpoint to authenticated users
Cloud and on-premises SQL Server instances covered by the Microsoft Security Update Guide

Discovery Timeline

2026-09-08 - CVE-2026-67384 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-67384

Vulnerability Analysis

The vulnerability originates in a SQL Server code path that performs arithmetic on attacker-influenced size values before allocating a heap buffer. When those values wrap around, SQL Server allocates a buffer smaller than the data subsequently written into it. The resulting heap-based buffer overflow ([CWE-122]) corrupts adjacent memory structures within the sqlservr.exe process. An attacker who already possesses valid database credentials can send crafted requests to reach the vulnerable routine over the network. The Microsoft advisory does not disclose the specific stored procedure or protocol handler affected. See the Microsoft Security Update Guide CVE-2026-67384 for authoritative technical detail.

Root Cause

The root cause is improper validation of a size or length field used in a memory allocation calculation. Multiplication or addition on untrusted input wraps past the size_t boundary, producing a small allocation. Subsequent copy operations write beyond the allocated buffer, corrupting heap metadata and adjacent objects.

Attack Vector

Exploitation requires network access to the SQL Server listener and valid low-privileged credentials. No user interaction is required. An attacker submits a crafted request containing size fields designed to trigger the integer wraparound. The resulting heap corruption can be shaped to achieve arbitrary code execution within the SQL Server service account context, which frequently holds elevated privileges on the host.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-67384

Indicators of Compromise

Unexpected crashes or access violations logged by sqlservr.exe in the SQL Server ERRORLOG or Windows Application event log
SQL Server process spawning unusual child processes such as cmd.exe, powershell.exe, or rundll32.exe
Anomalous outbound network connections originating from the SQL Server service account
Unexplained new logins, jobs, or extended stored procedure registrations

Detection Strategies

Monitor SQL Server audit logs for authenticated sessions issuing malformed or unusually large parameterized requests
Alert on process lineage where sqlservr.exe is the parent of interactive shells or scripting hosts
Correlate SQL Server crash dumps with concurrent authentication events from unexpected source addresses

Monitoring Recommendations

Enable SQL Server extended events and Windows Defender ATP or equivalent EDR telemetry on all database hosts
Forward SQL Server ERRORLOG and Windows event data to a centralized SIEM for correlation
Baseline normal query and login patterns per application account to surface deviations quickly

How to Mitigate CVE-2026-67384

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide CVE-2026-67384 to all affected SQL Server instances
Inventory SQL Server deployments, including cloud, container, and developer instances, to confirm patch coverage
Rotate credentials for any database account that could reach the network endpoint of a vulnerable server

Patch Information

Microsoft has published guidance and updates through the Microsoft Security Update Guide. Administrators should install the cumulative update or security-only patch corresponding to their SQL Server major version and build. Restart the SQL Server service after installation to load the fixed binaries.

Workarounds

Restrict network access to SQL Server ports using firewall rules and network segmentation so only trusted application hosts can connect
Enforce least-privilege principles for all database logins and disable unused accounts to reduce the attacker pool
Require Windows Authentication and multi-factor authentication for administrative access where supported

bash

# Example: restrict inbound access to SQL Server (TCP 1433) using Windows Firewall
New-NetFirewallRule -DisplayName "Restrict SQL Server 1433" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 1433 `
  -RemoteAddress 10.0.0.0/24 `
  -Action Allow