CVE-2026-73029: SQL Server Information Disclosure Vulnerability

CVE-2026-73029 Overview

CVE-2026-73029 is a buffer over-read vulnerability in Microsoft SQL Server that allows an authorized attacker to disclose information over a network. The flaw is categorized under [CWE-126] (Buffer Over-read) and enables an authenticated attacker to read memory beyond an intended buffer boundary. Successful exploitation can expose sensitive process memory contents to a remote client with valid credentials. Microsoft published the advisory through the Microsoft Security Response Center (MSRC), and the issue affects supported SQL Server releases as tracked in the Microsoft Security Update Guide CVE-2026-73029.

Critical Impact
An authenticated remote attacker can read out-of-bounds memory from the SQL Server process, potentially disclosing sensitive database content, credentials, or in-memory secrets.

Affected Products

Microsoft SQL Server (see the Microsoft Security Update Guide CVE-2026-73029 for the authoritative list of affected builds)

Discovery Timeline

2026-09-08 - CVE-2026-73029 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-73029

Vulnerability Analysis

The vulnerability is a buffer over-read in the SQL Server database engine. A buffer over-read occurs when code reads past the intended end of a memory buffer and returns adjacent process memory to the caller. The attack requires network access to a reachable SQL Server instance and valid, low-privileged authentication such as any account permitted to submit queries. No user interaction is required, and exploitation does not modify data or affect availability, only confidentiality. Disclosed memory may include fragments of query results belonging to other sessions, cached credentials, session tokens, or internal pointers useful for further attacks against the SQL Server process.

Root Cause

The underlying weakness is classified as [CWE-126] Buffer Over-read. This class of flaw typically arises when a length or offset value used during a read operation is not properly validated against the true bounds of the source buffer. In SQL Server, such flaws commonly appear in parsers, serializers, or query-processing paths that operate on client-supplied structures. Microsoft has not published root-cause internals for this specific issue.

Attack Vector

Exploitation is performed over the network against the SQL Server TDS listener. The attacker authenticates using any account with query submission rights, then issues a crafted request that triggers the over-read. The vulnerable code path returns extra bytes of adjacent memory to the attacker within the response stream. Because the vulnerability is scoped to information disclosure only, the attacker cannot directly execute code or alter data through this flaw. Attackers frequently chain such disclosures with other weaknesses to escalate impact.

No public proof-of-concept exploit has been observed at the time of publication, and CISA has not added CVE-2026-73029 to the Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-73029

Indicators of Compromise

Unusual volumes of malformed or oversized T-SQL requests from a single authenticated principal.
SQL Server error log entries referencing unexpected parsing errors or access violations correlated with a specific session.
Anomalous binary or non-printable data appearing in application-side query result logs.
Query patterns from service accounts that deviate sharply from historical baselines.

Detection Strategies

Enable SQL Server Extended Events or Audit to capture failed and unusual statement patterns per login.
Alert on repeated exceptions in the error_reported event tied to the same session_id.
Baseline expected query shapes for each application login and flag deviations for review.
Inspect network traffic to TCP 1433 for abnormally structured TDS packets from non-standard clients.

Monitoring Recommendations

Forward SQL Server audit logs and Windows event logs to a centralized analytics platform for correlation.
Monitor authentication events for low-privileged accounts issuing atypical query volumes.
Track outbound response sizes from SQL Server sessions to identify inflated result payloads.

How to Mitigate CVE-2026-73029

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide CVE-2026-73029 to all affected SQL Server instances.
Inventory SQL Server deployments, including containerized and cloud-hosted instances, and prioritize internet-exposed systems.
Rotate credentials and secrets that may have been resident in SQL Server memory if exploitation is suspected.
Review database principals and remove unused or over-privileged logins that could be abused for authenticated access.

Patch Information

Microsoft has released fixes for supported SQL Server versions through the Microsoft Security Update Guide. Administrators should consult the Microsoft Security Update Guide CVE-2026-73029 for the specific cumulative update or GDR package matching each SQL Server build and apply the vendor-recommended update.

Workarounds

Restrict network access to SQL Server using firewall rules so only trusted application hosts can reach TCP 1433.
Enforce least privilege on database logins and revoke query rights from accounts that do not require them.
Require strong authentication and disable legacy SQL logins where Windows or Entra ID authentication is available.
Place SQL Server behind a private network segment and prohibit direct exposure to untrusted networks.

bash

# Configuration example: restrict SQL Server exposure with Windows Firewall
New-NetFirewallRule -DisplayName "SQL Server 1433 - Trusted App Tier Only" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 1433 `
  -RemoteAddress 10.20.30.0/24 `
  -Action Allow

New-NetFirewallRule -DisplayName "SQL Server 1433 - Block All Other" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 1433 `
  -Action Block