CVE-2026-88089
MediumCVSS 6.7Summary
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally. An attacker could exploit this to run arbitrary code in the context of the SQL Server process.
Risk Assessment
The organization may be exposed to malicious code execution on the database server, potentially leading to full system compromise and data exfiltration.
Recommendation
Immediately update SQL Server to a version containing the fix. Also restrict local access to the database server.
Other vulnerabilities in SQL Server
See all- CVE-2026-96956High
Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
- CVE-2026-94520Medium
Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network. An attacker could exploit this to disrupt service availability.
- CVE-2026-88086Medium
Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over an adjacent network. An attacker could exploit this to access sensitive data.
- CVE-2026-88085Medium
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally. The vulnerability resides in the database component and requires prior access to the system.
- CVE-2026-88084Medium
Allocation of resources without limits or throttling in SQL Server allows an authorized attacker to deny service over a network. Resource exhaustion may render the service unavailable.
- CVE-2026-85888High
An out-of-bounds read vulnerability in SQL Server allows an authorized attacker to disclose information over a network.
- CVE-2026-85886High
A heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
- CVE-2026-85876High
A use-after-free vulnerability in SQL Server allows an authorized attacker to elevate privileges locally.
- CVE-2026-83945Medium
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. The vulnerability affects the database component and requires valid credentials.
- CVE-2026-70189Medium
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally. The vulnerability requires system access with valid credentials.
Original NVD description (English source)
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS