CVE-2026-67629: SQL Server Information Disclosure Flaw

CVE-2026-67629 Overview

CVE-2026-67629 is an out-of-bounds read vulnerability [CWE-125] in Microsoft SQL Server. An authenticated attacker with low privileges can exploit the flaw over a network to read memory beyond intended buffer boundaries. Successful exploitation discloses sensitive information from the SQL Server process memory space.

The vulnerability affects confidentiality only. It does not impact data integrity or service availability. Microsoft published the advisory on September 8, 2026, and assigned a CVSS 3.1 base score of 6.5.

Critical Impact
Authenticated attackers can trigger an out-of-bounds read in SQL Server to disclose sensitive in-memory data across the network, potentially exposing credentials, query results, or other database internals.

Affected Products

Microsoft SQL Server (specific versions listed in the Microsoft CVE-2026-67629 Advisory)
SQL Server instances accessible over the network with valid database credentials
Environments where low-privileged database accounts can issue queries to the affected engine

Discovery Timeline

2026-09-08 - CVE-2026-67629 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-67629

Vulnerability Analysis

The vulnerability is an out-of-bounds read within SQL Server. When processing certain crafted inputs, the server reads memory outside the bounds of an allocated buffer. The out-of-range data is then returned in a way that is observable to the authenticated caller.

Exploitation requires network access to the SQL Server instance and valid low-privileged credentials. No user interaction is needed, and the attack complexity is low. The impact is limited to information disclosure; there is no direct code execution or tampering primitive.

The EPSS probability at publication is 0.714%, indicating limited near-term exploitation prediction. No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported at the time of publication.

Root Cause

The root cause is missing or incorrect bounds validation on a buffer accessed during query or protocol processing in SQL Server. The affected code path reads past the end of an allocated structure, returning adjacent process memory. This class of defect is classified under [CWE-125] (Out-of-bounds Read).

Attack Vector

The attack vector is network based. An attacker authenticates to SQL Server using a low-privileged account, then submits a crafted request that triggers the vulnerable read path. Server memory adjacent to the target buffer is returned to the attacker, enabling extraction of sensitive artifacts such as credentials, tokens, or fragments of query data.

Refer to the Microsoft CVE-2026-67629 Advisory for vendor-specific technical detail. No verified public exploit code is available at this time.

Detection Methods for CVE-2026-67629

Indicators of Compromise

Unusual query patterns from low-privileged SQL logins targeting system objects or crafted parameters that repeatedly probe the same code path.
Elevated volume of failed or malformed T-SQL requests originating from a single authenticated session or client IP.
Unexpected outbound data volumes from database sessions belonging to service or reporting accounts.

Detection Strategies

Enable SQL Server auditing on SUCCESSFUL_LOGIN_GROUP and SCHEMA_OBJECT_ACCESS_GROUP to correlate low-privilege activity with anomalous query shapes.
Baseline normal query fingerprints per application account and alert on statistical deviations that align with repeated probing.
Deploy network detection rules on the Tabular Data Stream (TDS) protocol to flag malformed or oversized parameter payloads.

Monitoring Recommendations

Forward SQL Server audit logs and Windows Security events to a centralized SIEM for cross-source correlation.
Monitor sys.dm_exec_sessions and sys.dm_exec_requests for long-running sessions issuing atypical parameterized queries.
Alert on new or dormant low-privilege database accounts that suddenly generate high query volumes against sensitive schemas.

How to Mitigate CVE-2026-67629

Immediate Actions Required

Apply the Microsoft security update for CVE-2026-67629 to all affected SQL Server instances as identified in the vendor advisory.
Inventory all SQL Server deployments, including containerized and cloud-hosted instances, to confirm patch coverage.
Review and reduce database logins with PUBLIC or minimal privileges that can still authenticate to the engine.

Patch Information

Microsoft has published guidance and updates in the Microsoft CVE-2026-67629 Advisory. Administrators should consult the advisory for the specific cumulative update, GDR, or security-only package that applies to each SQL Server build in use, and validate patch application via SELECT @@VERSION.

Workarounds

Restrict network access to SQL Server using firewall rules so that only trusted application hosts can reach TCP port 1433 and any configured dynamic ports.
Rotate credentials for low-privileged and application service accounts, and disable dormant SQL logins.
Enforce TLS for all SQL Server client connections to reduce exposure of any disclosed data to passive network observers.

bash

# Configuration example: restrict SQL Server exposure at the host firewall
netsh advfirewall firewall add rule name="SQL Server - App Tier Only" ^
  dir=in action=allow protocol=TCP localport=1433 ^
  remoteip=10.10.20.0/24 profile=domain

netsh advfirewall firewall add rule name="SQL Server - Block Other" ^
  dir=in action=block protocol=TCP localport=1433