CVE-2026-67628: SQL Server Information Disclosure Vulnerability

CVE-2026-67628 Overview

CVE-2026-67628 is an out-of-bounds read vulnerability [CWE-125] in Microsoft SQL Server. An authorized attacker with high privileges can send crafted requests over a network to read memory outside the intended buffer boundaries. Successful exploitation leads to information disclosure from the SQL Server process memory.

The flaw does not permit modification of data or disruption of availability. However, leaked memory contents may include sensitive query data, authentication artifacts, or internal server state that assists follow-on attacks.

Critical Impact
Authenticated attackers can disclose SQL Server process memory contents remotely, potentially exposing cached query data, credentials, or other sensitive information resident in server memory.

Affected Products

Microsoft SQL Server (specific builds listed in the Microsoft Security Response Center advisory)

Discovery Timeline

2026-10-13 - CVE CVE-2026-67628 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-67628

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds read [CWE-125] in SQL Server. The flaw occurs when the server processes certain input and reads data past the end of an allocated buffer. The read operation returns memory that was never intended to be exposed to the requesting session.

Attackers who already hold authenticated access to the database can trigger the condition over the network. The exposed memory may contain fragments of other sessions' data, cached buffers, or structural metadata. Confidentiality is directly impacted while integrity and availability remain intact.

The EPSS score is 0.536% as of 2026-10-14, indicating a low near-term exploitation probability. Still, the networked, authenticated attack surface warrants prompt remediation in multi-tenant and shared-database environments where privileged database accounts are distributed broadly.

Root Cause

The root cause is missing or incorrect bounds validation during the parsing of a request processed by SQL Server. When the server reads from a buffer, it does not verify that the computed offset or length stays within allocated memory. The resulting read returns adjacent memory to the attacker.

Attack Vector

Exploitation requires network reachability to the SQL Server instance and a valid authenticated session with elevated database privileges. The attacker submits a crafted query, command, or protocol message that triggers the out-of-bounds read. The server returns the leaked bytes in the response, which the attacker captures.

No user interaction is required, and the attack does not cross a security boundary beyond the SQL Server process itself. See the Microsoft Vulnerability Update CVE-2026-67628 advisory for product-specific exploitation details.

Detection Methods for CVE-2026-67628

Indicators of Compromise

Unusual query patterns from privileged database accounts, especially repeated calls with abnormal parameter sizes, offsets, or malformed binary payloads.
Elevated volumes of error responses or oversized response payloads returned to a single authenticated session.
Access to the SQL Server from unexpected source hosts using service or administrative credentials.

Detection Strategies

Enable SQL Server auditing for high-privilege logins and capture full statement text for sessions holding sysadmin, db_owner, or equivalent roles.
Correlate SQL Server error log entries referencing memory access, dump generation, or exception codes with specific session identifiers.
Baseline normal query payload sizes per application and alert on deviations that may indicate crafted exploit traffic.

Monitoring Recommendations

Forward SQL Server audit logs and Windows event logs to a centralized analytics platform for cross-source correlation.
Monitor authenticated outbound sessions from database hosts for data staging consistent with disclosed memory being exfiltrated.
Track changes in privileged account usage, including off-hours access and new client hosts connecting with elevated roles.

How to Mitigate CVE-2026-67628

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Vulnerability Update CVE-2026-67628 advisory to all affected SQL Server instances.
Inventory SQL Server deployments and prioritize patching on internet-exposed and multi-tenant instances.
Review and reduce the number of accounts holding high-privilege database roles.

Patch Information

Microsoft has published a security update for this vulnerability. Administrators should consult the Microsoft Security Response Center advisory to identify the specific cumulative update or GDR package that corresponds to each affected SQL Server build and servicing branch.

Workarounds

Restrict network access to SQL Server listeners using firewall rules so only trusted application hosts can reach TCP port 1433 and configured instance ports.
Enforce least privilege for database accounts and remove unnecessary membership in sysadmin and other elevated roles.
Require strong authentication, rotate service account credentials, and audit all logins that hold privileges sufficient to reach the vulnerable code path.

bash

# Configuration example: restrict SQL Server inbound access to a defined subnet on Windows
netsh advfirewall firewall add rule name="SQL Server 1433 Allow Trusted" ^
  dir=in action=allow protocol=TCP localport=1433 ^
  remoteip=10.0.10.0/24

netsh advfirewall firewall add rule name="SQL Server 1433 Block Other" ^
  dir=in action=block protocol=TCP localport=1433