CVE-2026-67643: Heap Buffer Overflow in SQL Server 2022 and 2025

CVE-2026-67643 is a critical (CVSS 9.8) heap based buffer overflow in Microsoft SQL Server. Microsoft's record says an unauthorized attacker could execute code over a network. It lists SQL Server 2022 and 2025. Install the Microsoft security update for your version and confirm the fixed build in Microsoft's advisory.

What's affected

• Product: Microsoft SQL Server, in these versions per the record: SQL Server 2022 and 2025.
• Weakness: CWE-122 heap based buffer overflow.
• Severity: CVSS 3.1 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No privileges or user interaction are needed.
• Fixed version: not confirmed. Microsoft's page needs JavaScript and did not load for me, so check it for the fixed build of each SQL Server version.

How to check if you're exposed

Read the version of each SQL Server instance:

SELECT @@VERSION;
SELECT SERVERPROPERTY('ProductVersion') AS version, SERVERPROPERTY('ProductUpdateLevel') AS update_level;

Compare the build number with the fixed build in Microsoft's advisory for this CVE. I could not read that number from the advisory page, so confirm it there. Also find instances you may have forgotten: developer machines, test servers, and SQL Server Express copies embedded in applications. Note which instances accept connections from outside their own subnet.

What to do now

1. Inventory SQL Server instances and their build numbers.
2. Read Microsoft's advisory for the fixed build for each version you run.
3. Install the update, testing first on a non production copy where you can.
4. Restrict network access so only application servers and admin hosts can reach the SQL port.
5. Confirm the new build number with SELECT @@VERSION after the restart.

Why it matters

This is the narrower of two heap overflow entries for SQL Server in the same release. The record lists only SQL Server 2022 and 2025, which suggests the vulnerable code is newer than the code behind CVE-2026-67631, which also lists 2017 and 2019.

The impact is the same as for any network heap overflow with no privileges: code execution on the database host is the stated outcome. If you run 2022 or 2025, you are in range for both entries, so apply the update that covers them. The record reports no exploitation and the CISA KEV flag is false.

Quick check

Sources

• Microsoft Security Response Center entry (listed in the record; its page needs JavaScript, so I could not read build numbers from it)
• Gold record for CVE-2026-67643

Last reviewed: 19 October 2026.