CVE-2026-65674
HighCVSS 8.8Summary
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
Risk Assessment
An authenticated attacker could remotely execute arbitrary code by supplying malicious data for deserialization, potentially leading to takeover of the database server.
Recommendation
Apply available SQL Server security updates and restrict the ability to submit untrusted data to the instance.
Other vulnerabilities in SQL Server
See all- CVE-2026-96956High
Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
- CVE-2026-85888High
An out-of-bounds read vulnerability in SQL Server allows an authorized attacker to disclose information over a network.
- CVE-2026-85886High
A heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
- CVE-2026-85876High
A use-after-free vulnerability in SQL Server allows an authorized attacker to elevate privileges locally.
- CVE-2026-68883High
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
- CVE-2026-67625High
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
- CVE-2026-67636Critical
An out-of-bounds read in SQL Server allows an unauthorized attacker to execute code over a network.
- CVE-2026-67378Critical
An untrusted pointer dereference in SQL Server allows an unauthorized attacker to execute code over a network.
- CVE-2026-65669Critical
Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-54118Critical
A vulnerability in SQL Server allows an unauthorized attacker to execute code over a network through deserialization of untrusted data.
Original NVD description (English source)
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS