CVE-2026-67641

An out-of-bounds read in SQL Server allows an unauthorized attacker to execute code over a network.

An untrusted pointer dereference in SQL Server allows an unauthorized attacker to execute code over a network.

Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate privileges over a network.

A vulnerability in SQL Server allows an unauthorized attacker to execute code over a network through deserialization of untrusted data.

A vulnerability in SQL Server allows an unauthorized attacker to execute code over a network through deserialization of untrusted data.

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

Integer underflow (wrap or wraparound) in SQL Server allows an authorized attacker to disclose information locally.

SQL Server has improper access control that allows an authorized attacker to elevate privileges over a network.

SQL Server has an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code over a network.

SQL Server has a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.