CVE-2026-67385 Overview
CVE-2026-67385 is a use-after-free vulnerability [CWE-416] in Microsoft SQL Server that allows an authenticated attacker to execute arbitrary code over a network. The flaw arises when SQL Server references memory after it has been freed, enabling controlled reuse of freed objects during query or connection processing. Successful exploitation grants the attacker code execution in the context of the SQL Server process, which typically holds elevated privileges on the host. Microsoft published details for this issue in the Microsoft Security Response Center advisory.
Critical Impact
An authenticated attacker with low-privilege database access can execute code on the SQL Server host, compromising database confidentiality, integrity, and availability.
Affected Products
- Microsoft SQL Server (see the Microsoft advisory for supported version list and build numbers)
Discovery Timeline
- 2026-09-08 - CVE-2026-67385 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-67385
Vulnerability Analysis
The vulnerability is a use-after-free condition inside Microsoft SQL Server. The database engine retains a pointer to a heap object that has already been released, then dereferences that pointer during subsequent operations. An attacker who can influence allocation and deallocation ordering can reclaim the freed slot with attacker-controlled data. Dereferencing the stale pointer then leads to memory corruption that can be steered into arbitrary code execution.
Exploitation requires network reachability to the SQL Server instance and valid credentials with low privileges. No user interaction is needed. Code executes in the SQL Server service context, providing a foothold for lateral movement, credential theft from linked servers, and access to database contents.
Root Cause
The root cause is improper object lifetime management within SQL Server internals, categorized as [CWE-416] Use After Free. A code path releases a memory object while other code retains and later dereferences a reference to it. Microsoft has not disclosed the specific component or query path in public materials. Consult the MSRC advisory for component-level details.
Attack Vector
An authenticated attacker sends crafted requests to the SQL Server instance over the network. The requests trigger the vulnerable allocation and free sequence, then reuse the freed memory before the stale reference is dereferenced. The resulting corruption is leveraged to hijack control flow and execute code in the SQL Server process.
No public proof-of-concept code exists for CVE-2026-67385 at the time of publication. Refer to the Microsoft advisory for the technical constraints on exploitation.
Detection Methods for CVE-2026-67385
Indicators of Compromise
- Unexpected SQL Server process crashes or access violation events in the Windows Application log correlated with active database sessions.
- New or unexpected child processes spawned by sqlservr.exe, such as cmd.exe, powershell.exe, or scripting hosts.
- Anomalous outbound network connections initiated by the SQL Server service account following authenticated sessions from unusual sources.
Detection Strategies
- Monitor SQL Server error logs for repeated stack dumps, exception codes, and access violations that may indicate exploitation attempts against the vulnerable code path.
- Baseline authenticated logins by source address and account, then alert on sessions from unexpected hosts or service accounts issuing atypical query patterns.
- Correlate process-lineage telemetry showing sqlservr.exe spawning shells, LOLBins, or network utilities with recent inbound TDS connections.
Monitoring Recommendations
- Enable SQL Server audit for successful and failed logins, and forward Windows Security and Application event logs to a centralized analytics platform.
- Alert on modifications to SQL Agent jobs, extended stored procedures, and CLR assemblies created shortly after authenticated connections.
- Track service account behavior for privilege escalation attempts, token manipulation, and credential access patterns aligned with MITRE ATT&CK techniques T1055 and T1078.
How to Mitigate CVE-2026-67385
Immediate Actions Required
- Apply the Microsoft security update for CVE-2026-67385 to all affected SQL Server instances as documented in the MSRC advisory.
- Inventory SQL Server hosts exposed beyond the database tier and restrict network reachability to authorized application servers and administrators.
- Rotate credentials for SQL logins with broad access and review server roles for accounts granted more privilege than required.
Patch Information
Microsoft has released fixed builds through its standard servicing channels. Refer to the Microsoft CVE-2026-67385 Update guidance for the specific cumulative update or GDR package corresponding to each supported SQL Server version.
Workarounds
- Restrict TDS port access (default TCP 1433 and dynamic ports for named instances) using host and network firewalls to trusted sources only.
- Enforce least-privilege for all SQL logins, remove sysadmin membership from application accounts, and disable unused authentication providers.
- Run the SQL Server service under a low-privilege domain account to limit blast radius if code execution occurs.
# Example: restrict SQL Server TDS port to specific application servers on Windows
New-NetFirewallRule -DisplayName "SQL Server 1433 - App Tier Only" `
-Direction Inbound -Protocol TCP -LocalPort 1433 `
-RemoteAddress 10.10.20.0/24 -Action Allow
New-NetFirewallRule -DisplayName "Block SQL Server 1433 - All Others" `
-Direction Inbound -Protocol TCP -LocalPort 1433 `
-Action Block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
