High · 7.5 CVE-2026-88083 EUVD-2026-100610GHSA-wf75-4r9h-4xcw

Microsoft SQL Server Remote Code Execution Vulnerability

Published Oct 13, 2026 · Updated Nov 10, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Microsoft SQL Server 2022 (GDR) Product: Microsoft SQL Server 2022 for x64-based Systems (CU27) Product: Microsoft SQL Server 2025 for x64-based Systems (CU9) Product: Microsoft SQL Server 2025 for x64-based Systems (GDR)

Description

Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.

Affected products

Vendor	Product	Affected	Fixed
Microsoft	Microsoft SQL Server 2022 (GDR)	16.0.0 – < 16.0.1210.3	16.0.1210.3
Microsoft	Microsoft SQL Server 2022 for x64-based Systems (CU27)	16.0.4003.1 – < 16.0.4305.5	16.0.4305.5
Microsoft	Microsoft SQL Server 2025 for x64-based Systems (CU9)	17.0.4006.2 – < 17.0.5015.4	17.0.5015.4
Microsoft	Microsoft SQL Server 2025 for x64-based Systems (GDR)	17.0.1050.2 – < 17.0.1145.4	17.0.1145.4

Advisories 3

WID-SEC-2026-3917 Microsoft SQL Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 14, 2026
NCSC-2026-0420 Kwetsbaarheden verholpen in Microsoft SQL Server NCSC-NL (Netherlands) · Oct 13, 2026
MSRC-CVE-2026-88083 Microsoft SQL Server Remote Code Execution Vulnerability Microsoft Security Response Center · Oct 13, 2026

References

Microsoft SQL Server Remote Code Execution Vulnerability vendor-advisory patch