CVE-2026-67636: SQL Server Out-of-Bounds RCE Vulnerability

CVE-2026-67636 Overview

CVE-2026-67636 is an out-of-bounds read vulnerability in Microsoft SQL Server that allows an authenticated attacker to execute code over a network. The flaw is classified under [CWE-125] and stems from the database engine reading memory beyond an allocated buffer boundary. An attacker with low-privilege database access can exploit the condition to leak sensitive memory contents and achieve remote code execution on the SQL Server host. Successful exploitation can compromise confidentiality, integrity, and availability of the database service and change security scope beyond the vulnerable component.

Critical Impact
An authenticated network attacker can trigger an out-of-bounds read in SQL Server to execute arbitrary code, potentially compromising the host and any data the SQL Server process can access.

Affected Products

Microsoft SQL Server (see Microsoft Security Update CVE-2026-67636 for specific build and version coverage)

Discovery Timeline

2026-09-08 - CVE-2026-67636 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-67636

Vulnerability Analysis

The vulnerability is an out-of-bounds read in SQL Server. The database engine reads data past the end of an allocated buffer while processing attacker-supplied input. This exposes adjacent memory contents to the attacker's session and, in this case, can be chained to achieve code execution on the SQL Server process.

Exploitation requires an authenticated database session with at least low privileges. No user interaction is required, and the attack is delivered over the network through normal SQL Server protocol channels. Because the scope changes on successful exploitation, code execution can affect resources outside the immediate database session context.

The technical details of the parsing path and the specific query or protocol structure that triggers the read have not been published. Microsoft's advisory is the authoritative source for downstream information and patch mapping.

Root Cause

The root cause is missing or inadequate bounds validation in a SQL Server code path that indexes into a memory buffer using values derived from client input. When the computed offset or length exceeds the allocated buffer size, the engine reads adjacent process memory. This memory can include pointers, table metadata, or execution state that an attacker uses to influence subsequent operations and reach code execution.

Attack Vector

The attack vector is network-based. An authenticated attacker sends crafted requests to the SQL Server instance over its standard listening port. The malformed input causes the vulnerable routine to read beyond the allocated buffer, disclose memory, and, when combined with additional primitives, trigger arbitrary code execution in the context of the SQL Server service account.

No verified proof-of-concept code is publicly available at the time of publication. The EPSS score is 0.475%. Refer to the Microsoft Security Update CVE-2026-67636 advisory for technical details as Microsoft releases them.

Detection Methods for CVE-2026-67636

Indicators of Compromise

Unexpected crashes, access violations, or restarts of the sqlservr.exe process on database hosts.
Anomalous queries or malformed Tabular Data Stream (TDS) requests originating from low-privilege database accounts.
SQL Server error log entries referencing memory access violations, dump generation, or stack traces in query processing components.
Outbound network connections or new child processes spawned by the SQL Server service account.

Detection Strategies

Correlate authentication events with sessions that immediately precede SQL Server crashes or memory dumps.
Monitor for process lineage anomalies where sqlservr.exe spawns cmd.exe, powershell.exe, or other interactive shells.
Baseline normal query patterns per service account and alert on statistically anomalous statement structures or binary payloads.

Monitoring Recommendations

Enable SQL Server Audit for logon events, failed logons, and privileged action events, and forward logs to a centralized SIEM.
Ingest Windows Security and Sysmon telemetry from database hosts to capture process creation, module loads, and network connections tied to the SQL Server service.
Track database account activity from non-application source IPs, which is a common precursor to authenticated exploitation.

How to Mitigate CVE-2026-67636

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-67636 advisory to all affected SQL Server instances.
Inventory SQL Server deployments, including embedded and SQL Server Express instances, to ensure full patch coverage.
Rotate credentials for any low-privilege database accounts that are exposed to untrusted networks or shared across environments.
Review database account privileges and remove unnecessary logins, especially accounts with broad server-level access.

Patch Information

Microsoft has published an advisory and update for this vulnerability. Consult the Microsoft Security Update CVE-2026-67636 page for the specific cumulative update, GDR, or security-only package that maps to each supported SQL Server version and branch.

Workarounds

Restrict network access to SQL Server listeners so only trusted application hosts can reach TCP 1433 or the configured port.
Enforce least privilege on database logins and remove sysadmin or elevated roles from application accounts that do not require them.
Require encrypted connections and strong authentication to reduce the exposure of database credentials that could be reused for exploitation.

bash

# Configuration example: restrict SQL Server access with Windows Firewall
# Replace 10.0.0.0/24 with your trusted application subnet
New-NetFirewallRule -DisplayName "Allow SQL Server from AppTier" \
  -Direction Inbound -Protocol TCP -LocalPort 1433 \
  -RemoteAddress 10.0.0.0/24 -Action Allow

New-NetFirewallRule -DisplayName "Block SQL Server from Other Networks" \
  -Direction Inbound -Protocol TCP -LocalPort 1433 \
  -Action Block