{"id":"CVE-2026-116945","published":"2026-11-10T19:19:27.737","lastModified":"2026-11-11T05:19:26.887","description":"Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-122"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-116945","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A heap-based buffer overflow (CWE-122) exists in SQL Server, allowing remote code execution without authentication due to improper input validation over the network. The CVSS 9.8 score indicates maximum impact across confidentiality, integrity, and availability.","exploitability":"Exploitation is highly likely for unauthorized remote attackers due to low attack complexity and no required privileges or user interaction.","blast_radius":"Successful exploitation could enable full system compromise of the SQL Server host, potentially leading to lateral movement within the database tier and access to sensitive data across connected systems.","remediation":"No fixed version or patch level is specified in the description; upgrade to the latest supported cumulative update for Microsoft SQL Server and apply all security updates as soon as available, while restricting network exposure of SQL Server instances to trusted zones only.","detection":"No reliable host or network indicator is derivable from the published description.","tags":[],"model":"garnet-coder","analyzedAt":"2026-11-11T09:50:46.582Z"}}