CVE-2026-67645: SQL Server Information Disclosure Flaw

CVE-2026-67645 Overview

CVE-2026-67645 is an out-of-bounds read vulnerability in Microsoft SQL Server that enables an authenticated attacker to disclose sensitive information over a network. The flaw is classified under [CWE-125] (Out-of-bounds Read) and requires low privileges with no user interaction. Successful exploitation allows an attacker to read memory contents outside allocated buffer boundaries, potentially exposing database contents, credentials, or other sensitive process memory.

Critical Impact
An authorized attacker with low-level database privileges can remotely read out-of-bounds memory from SQL Server, resulting in confidentiality loss without affecting integrity or availability.

Affected Products

Microsoft SQL Server (specific versions listed in Microsoft Security Update Guide)
Any application relying on the vulnerable SQL Server database engine
Managed and on-premises SQL Server deployments accepting authenticated network connections

Discovery Timeline

2026-09-08 - CVE CVE-2026-67645 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-67645

Vulnerability Analysis

The vulnerability resides in SQL Server's handling of specific query or protocol structures that lack sufficient bounds checking. When an authenticated attacker submits a crafted request, the database engine reads memory past the intended buffer boundary. The disclosed memory can contain fragments of other queries, cached data, or internal server state.

Exploitation requires network access to the SQL Server instance and valid credentials with minimal privileges. No user interaction is required, and the attack complexity is low. The scope remains unchanged, meaning the impact is limited to the SQL Server process. Only confidentiality is impacted; integrity and availability of the database service are not affected by this specific flaw.

Root Cause

The root cause is missing or inadequate boundary validation on input processed by the SQL Server engine. When the affected code path calculates a read length or offset, it fails to constrain the value to the allocated buffer size. This allows the process to return adjacent memory contents to the requesting client.

Attack Vector

The attack vector is network-based. An attacker authenticates to the SQL Server instance using any valid low-privilege account, then issues a crafted request that triggers the vulnerable read path. Response data returned to the attacker contains leaked memory bytes. Refer to the Microsoft Security Update Guide for protocol-level technical detail.

No verified proof-of-concept code is publicly available at this time. The vulnerability mechanism follows the standard pattern for [CWE-125] out-of-bounds reads in database engines: attacker-controlled length or index values propagate into a memory read operation without validation.

Detection Methods for CVE-2026-67645

Indicators of Compromise

Anomalous SQL query patterns from low-privilege accounts targeting internal system tables or metadata functions
Unusually large response payloads returned to authenticated database sessions that do not match expected query result sizes
Repeated malformed or edge-case parameter values in TDS (Tabular Data Stream) protocol traffic

Detection Strategies

Enable SQL Server audit logging for all authenticated sessions and review queries issued by service and application accounts
Baseline normal query response sizes per application and alert on statistically significant outliers
Monitor for SQL Server error events referencing access violations, memory faults, or unexpected termination of worker threads

Monitoring Recommendations

Forward SQL Server error logs and audit trails to a centralized SIEM for correlation across sessions
Track authentication events for accounts that suddenly issue queries outside their normal application scope
Instrument application-layer logs to correlate database calls with unexpected data returned to callers

How to Mitigate CVE-2026-67645

Immediate Actions Required

Apply the latest Microsoft security updates for SQL Server as listed in the Microsoft Security Update Guide
Inventory all SQL Server instances exposed to networks reachable by authenticated users and prioritize patching those first
Review database account privileges and revoke unnecessary logins to reduce the population of accounts able to reach the vulnerable code path

Patch Information

Microsoft has issued guidance through the Security Update Guide. Administrators should consult the Microsoft Security Update Guide to identify the correct cumulative update or security update for each affected SQL Server version and edition, then apply it during the next available maintenance window.

Workarounds

Restrict network access to SQL Server instances using firewall rules that limit connectivity to trusted application hosts
Enforce least-privilege on all database logins and remove access for dormant or shared accounts
Require TLS for all client connections and enable SQL Server audit to capture activity that can support post-incident analysis

bash

# Example: restrict SQL Server TCP 1433 to trusted subnets on Windows Firewall
New-NetFirewallRule -DisplayName "SQL Server - Allow trusted subnet" `
  -Direction Inbound -Protocol TCP -LocalPort 1433 `
  -RemoteAddress 10.10.20.0/24 -Action Allow

New-NetFirewallRule -DisplayName "SQL Server - Block all other" `
  -Direction Inbound -Protocol TCP -LocalPort 1433 `
  -Action Block