CVE-2026-116945

Summary

A heap-based buffer overflow (CWE-122) exists in SQL Server, allowing remote code execution without authentication due to improper input validation over the network. The CVSS 9.8 score indicates maximum impact across confidentiality, integrity, and availability.

Exploitability

Exploitation is highly likely for unauthorized remote attackers due to low attack complexity and no required privileges or user interaction.

Blast radius

Successful exploitation could enable full system compromise of the SQL Server host, potentially leading to lateral movement within the database tier and access to sensitive data across connected systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

No fixed version or patch level is specified in the description; upgrade to the latest supported cumulative update for Microsoft SQL Server and apply all security updates as soon as available, while restricting network exposure of SQL Server instances to trusted zones only.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.