CVE-2026-67636 is a critical (CVSS 9.0) out of bounds read in Microsoft SQL Server. Microsoft's record says an unauthorized attacker could execute code over a network. It lists SQL Server 2019, 2022 and 2025. Install the Microsoft security update for your version and confirm the fixed build in Microsoft's advisory.
What's affected
- Product: Microsoft SQL Server, in these versions per the record: SQL Server 2019, 2022 and 2025.
- Weakness: CWE-125 out of bounds read.
- Severity: CVSS 3.1 9.0, vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. Attack complexity is high and the scope is changed. - Fixed version: not confirmed. Microsoft's page needs JavaScript and did not load for me, so check it for the fixed build of each SQL Server version.
How to check if you're exposed
Read the version of each SQL Server instance:
SELECT @@VERSION;
SELECT SERVERPROPERTY('ProductVersion') AS version, SERVERPROPERTY('ProductUpdateLevel') AS update_level;
Compare the build number with the fixed build in Microsoft's advisory for this CVE. I could not read that number from the advisory page, so confirm it there. Also find instances you may have forgotten: developer machines, test servers, and SQL Server Express copies embedded in applications. Note which instances accept connections from outside their own subnet.
What to do now
- Inventory SQL Server instances and their build numbers.
- Read Microsoft's advisory for the fixed build for each version you run.
- Install the update, testing first on a non production copy where you can.
- Restrict network access so only application servers and admin hosts can reach the SQL port.
- Confirm the new build number with SELECT @@VERSION after the restart.
Why it matters
An out of bounds read lets a program read memory beyond the data it was meant to use. By itself it usually leaks information. Microsoft's record says this one can lead to code execution, which suggests the read can be used to steer the program or to defeat memory protections.
As with the other SQL Server issues from the same release, the attack complexity is high and the scope is changed. The record does not report exploitation and the CISA KEV flag is false. Reading about one more SQL Server memory flaw can blur together, so treat the September update as a single job and apply it once for all of them.
Quick check
Is a read bug less serious than a write bug?
Not always. A read can leak data that helps defeat memory protections, and Microsoft's record says code execution is possible here.
Can one update cover all four SQL Server CVEs?
Check Microsoft's advisories. Each CVE has its own entry, but the fixes for one month usually arrive in the same security update.
Sources
- Microsoft Security Response Center entry (listed in the record; its page needs JavaScript, so I could not read build numbers from it)
- Gold record for CVE-2026-67636
Last reviewed: 19 October 2026.
