CVE-2026-67390: SQL Server Information Disclosure Flaw

CVE-2026-67390 Overview

CVE-2026-67390 is an information disclosure vulnerability in Microsoft SQL Server caused by a buffer over-read condition. An authenticated attacker with network access to the database engine can trigger the flaw to read memory beyond an intended buffer boundary. The disclosed memory may contain sensitive data processed by the SQL Server instance.

The issue is tracked under CWE-126: Buffer Over-read. Microsoft published the advisory on the MSRC Update Guide.

Critical Impact
An authenticated network attacker can read out-of-bounds memory from a SQL Server process, potentially disclosing sensitive database content or in-process credentials.

Affected Products

Microsoft SQL Server (specific supported versions listed in the Microsoft advisory)

Discovery Timeline

2026-09-08 - CVE-2026-67390 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-67390

Vulnerability Analysis

The vulnerability is a buffer over-read within SQL Server request handling. The affected code reads past the end of an allocated buffer while processing attacker-influenced input. The excess bytes are returned to or observable by the caller, producing an information disclosure primitive.

Exploitation requires an authenticated session against the SQL Server instance. No user interaction is needed, and the attack complexity is low. The impact is limited to confidentiality; integrity and availability of the database are not directly affected.

Disclosed memory may include fragments of query buffers, cached rows, session state, or authentication material resident in the SQL Server process. Because SQL Server frequently handles regulated data, even partial leakage carries downstream risk.

Root Cause

The defect stems from missing or incorrect bounds validation when the server processes a specific request field. The read operation uses a size derived from untrusted input without confirming it does not exceed the source buffer, matching the [CWE-126] pattern.

Attack Vector

An attacker authenticates to the SQL Server instance over the network using valid low-privilege credentials. The attacker then issues a crafted query or protocol message that triggers the over-read. Repeated requests can be used to harvest additional bytes from adjacent memory. Refer to the Microsoft Vulnerability Advisory CVE-2026-67390 for protocol-level details.

Detection Methods for CVE-2026-67390

Indicators of Compromise

Unusual volumes of malformed or repeated queries from a single authenticated principal against the SQL Server endpoint.
Client sessions issuing crafted TDS protocol messages that generate parser warnings or unexpected result set sizes.
Application accounts querying system or metadata objects outside their normal operational pattern.

Detection Strategies

Enable SQL Server Audit for FAILED_LOGIN_GROUP, SUCCESSFUL_LOGIN_GROUP, and SCHEMA_OBJECT_ACCESS_GROUP and forward events to a centralized SIEM for correlation.
Baseline query patterns per service account and alert on statistically anomalous request shapes or repeated identical queries returning oversized payloads.
Monitor for Extended Events sessions capturing error_reported events with severity levels above 16 tied to a single session ID.

Monitoring Recommendations

Ingest SQL Server error logs, Extended Events, and Windows Security logs into a centralized logging platform for continuous review.
Track outbound data volumes from SQL Server hosts to identify staged exfiltration following a successful read primitive.
Alert on new or unexpected principals connecting from application tiers that historically use fixed service accounts.

How to Mitigate CVE-2026-67390

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-67390 to all affected SQL Server instances.
Inventory SQL Server deployments, including containerized and cloud-hosted instances, and confirm patch state.
Rotate credentials for SQL logins and application service accounts that may have been exposed to unpatched instances.

Patch Information

Microsoft has issued security updates through the MSRC Update Guide. Administrators should identify the applicable cumulative update or GDR package for each SQL Server version and apply it during a scheduled maintenance window. Validate the fix by confirming the installed build number matches the fixed build listed in the vendor advisory.

Workarounds

Restrict network reachability to SQL Server ports (default TCP 1433) using firewalls, network security groups, and private endpoints so only trusted application tiers can connect.
Enforce least privilege on SQL logins and remove unused accounts to reduce the population of principals capable of triggering the flaw.
Require strong authentication and multi-factor protection for interactive database administrator access.

bash

# Verify the SQL Server product version and build after patching
sqlcmd -S <server> -Q "SELECT SERVERPROPERTY('ProductVersion') AS Version, SERVERPROPERTY('ProductLevel') AS Level, SERVERPROPERTY('ProductUpdateLevel') AS CU;"