CVE-2026-67378: Untrusted Pointer Dereference in SQL Server

CVE-2026-67378 is a critical (CVSS 9.0) untrusted pointer dereference in Microsoft SQL Server. Microsoft's record says an unauthorized attacker could execute code over a network. It lists SQL Server 2019, 2022 and 2025. Install the Microsoft security update for your version and confirm the fixed build in Microsoft's advisory.

What's affected

• Product: Microsoft SQL Server, in these versions per the record: SQL Server 2019, 2022 and 2025.
• Weakness: CWE-822 untrusted pointer dereference.
• Severity: CVSS 3.1 9.0, vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. Attack complexity is high and the scope is changed.
• Fixed version: not confirmed. Microsoft's page needs JavaScript and did not load for me, so check it for the fixed build of each SQL Server version.

How to check if you're exposed

Read the version of each SQL Server instance:

SELECT @@VERSION;
SELECT SERVERPROPERTY('ProductVersion') AS version, SERVERPROPERTY('ProductUpdateLevel') AS update_level;

Compare the build number with the fixed build in Microsoft's advisory for this CVE. I could not read that number from the advisory page, so confirm it there. Also find instances you may have forgotten: developer machines, test servers, and SQL Server Express copies embedded in applications. Note which instances accept connections from outside their own subnet.

What to do now

1. Inventory SQL Server instances and their build numbers.
2. Read Microsoft's advisory for the fixed build for each version you run.
3. Install the update, testing first on a non production copy where you can.
4. Restrict network access so only application servers and admin hosts can reach the SQL port.
5. Confirm the new build number with SELECT @@VERSION after the restart.

Why it matters

An untrusted pointer dereference happens when a program follows a memory address it took from input without checking it. If an attacker can choose the address, the program may read or write memory of their choosing, which is a path to code execution.

The attack complexity is high, which is why the score is 9.0 and not higher. Scope is changed, meaning the effect can reach beyond the database engine. The record gives no further detail and does not report exploitation, and the CISA KEV flag is false. A database server should rarely be reachable from broad networks, so reducing who can connect is a sensible step while you schedule the update.

Quick check

Sources

• Microsoft Security Response Center entry (listed in the record; its page needs JavaScript, so I could not read build numbers from it)
• Gold record for CVE-2026-67378

Last reviewed: 19 October 2026.