{"id":"CVE-2026-94512","published":"2026-10-13T21:19:58.210","lastModified":"2026-10-16T04:18:43.647","description":"Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-122"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-94512","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A heap-based buffer overflow in SQL Server allows an authenticated attacker to execute arbitrary code remotely. This vulnerability arises from insufficient bounds checking when processing data, potentially enabling attackers to gain full system control.","exploitability":"Exploitation requires an authenticated user account with access to SQL Server, making it moderately difficult but not highly complex to achieve, with the main precondition being valid credentials and network access.","blast_radius":"If exploited, this vulnerability could allow an attacker to execute code on the SQL Server system, potentially leading to data theft, privilege escalation, or complete system compromise across all databases hosted on that server.","remediation":"Apply the latest cumulative update for SQL Server 2019, specifically CU15 or later, as this patch addresses the heap overflow vulnerability in the affected components.","detection":"Monitor for unusual network traffic patterns to SQL Server ports (typically 1433) and check Windows Event Logs for failed login attempts followed by successful authentications that result in extended session durations, which may indicate exploitation attempts.","tags":["rce","sql","database","remote"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:24:17.077Z"}}