Loading vulnerability…
Microsoft SQL Server Integration Package Heap-Based Buffer Overflow RCE
CVE-2026-116945 is a heap-based buffer overflow in Microsoft SQL Server affecting SQL Server 2017, 2019, 2022, and 2025. An unauthenticated attacker controlling a network endpoint contacted by an affected integration package can return a specially crafted response that triggers arbitrary code execution when processed. Code executes in the integration service context. Microsoft rates the vulnerability Important with a CVSS v3.1 base score of 9.8 and assesses exploitation as less likely. At initial publication, no exploitation or prior public disclosure was reported.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution with the privileges of the integration service, potentially allowing access to sensitive information, modification or destruction of accessible data, and disruption of service availability. The extent of compromise depends on the service account's permissions and accessible resources; administrative or SYSTEM-level execution is not established.
If you can’t patch tonight, do this now.
No vendor-specified temporary workaround is available. Restricting SQL Server network access to trusted systems and minimizing external exposure are general hardening precautions, not a confirmed workaround; inbound restrictions alone do not address the malicious-response scenario involving an integration package's outbound connection.
Patch, then assume compromise.
Install the applicable November 2026 Microsoft SQL Server security update after identifying the installed version and servicing branch. Fixed releases are: SQL Server 2025 CU10+GDR, KB5129299, build 17.0.5045.3; SQL Server 2025 RTM+GDR, KB5132748, build 17.0.1155.3; SQL Server 2022 CU27+GDR2, KB5129300, build 16.0.4315.2; SQL Server 2022 RTM+GDR, KB5132747, build 16.0.1220.3; SQL Server 2019 CU32+GDR, KB5132745, build 15.0.4510.2; SQL Server 2019 RTM+GDR, KB5132751, build 15.0.2210.4; SQL Server 2017 CU31+GDR, KB5132746, build 14.0.3570.2; and SQL Server 2017 RTM+GDR, KB5132749, build 14.0.2150.2. Review Microsoft's update applicability ranges, prerequisites, and release support status before deployment. An installed version's absence from an update table does not by itself establish that it is unsupported.
No public exploits tracked yet. Mallory keeps watching.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.