CVE-2026-67628: Microsoft SQL Server Information Disclosure Vulnerability

Overview

Severity
Medium (CVSS 4.9)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Category
Information Disclosure
Exploit Status
Not Exploited
Exploitation Likelihood
Unlikely
Patch Tuesday
2026-Oct
Released
2026-10-13

Description

Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.

FAQ

I am running SQL Server on my system. What action do I need to take? Update your relevant version of SQL Server using the applicable October 2026 security update listed below. There are GDR and/or CU (Cumulative Update) updates offered for my version of SQL Server. How do I know which update to use? First, determine your SQL Server version number. For more information, see Microsoft Knowledge Base Article 321185 - How to determine the version, edition, and update level of SQL Server and its components. Second, locate the range containing your current version number in the following table. The corresponding update is the one you need to install. Note: If your version is not represented in the table, review the applicable update's prerequisites and the support status of your SQL Server release before choosing an update. Absence from this table alone does not establish that a version is unsupported. Update Number Title Version Apply if current product version is… This security update also includes servicing releases up through… 5126967 SQL Server 2025 CU9+GDR (October GDR 2026) 17.0.5015.4 17.0.4006.2 - 17.0.5005.3 KB5122048 - SQL2025 RTM CU9 5128492 SQL Server 2025 RTM+GDR (October GDR 2026) 17.0.1145.4 17.0.1000.7 - 17.0.1135.8 KB5122770 - Previous SQL2025 RTM GDR 5126934 SQL Server 2022 CU27+GDR1 (October GDR 2026) 16.0.4305.5 16.0.4003.1 - 16.0.4295.3 KB5104824 - SQL2022 RTM CU27 5128493 SQL Server 2022 RTM+GDR (October GDR 2026) 16.0.1210.3 16.0.1000.6 - 16.0.1200.5 KB5122771 - Previous SQL2022 RTM GDR 5128494 SQL Server 2019 CU32+GDR (October GDR 2026) 15.0.4500.2 15.0.4003.23 - 15.0.4490.9 KB5122772 - Previous SQL2019 RTM CU32 GDR 5128495 SQL Server 2019 RTM+GDR (October GDR 2026) 15.0.2200.2 15.0.2000.5 - 15.0.2190.7 KB5122773 - Previous SQL2019 RTM GDR 5128496 SQL Server 2017 CU31+GDR (October GDR 2026) 14.0.3560.2 14.0.3006.16 - 14.0.3550.4 KB5122774 - Previous SQL2017 RTM CU31 GDR 5128497 SQL Server 2017 RTM+GDR (October GDR 2026) 14.0

Affected Products (8)

SQL Server

  • Microsoft SQL Server 2017 for x64-based Systems (GDR)
  • Microsoft SQL Server 2019 for x64-based Systems (GDR)
  • Microsoft SQL Server 2022 for x64-based Systems (GDR)
  • Microsoft SQL Server 2025 for x64-based Systems (GDR)
  • Microsoft SQL Server 2017 for x64-based Systems (CU31)
  • Microsoft SQL Server 2019 for x64-based Systems (CU32)
  • Microsoft SQL Server 2022 for x64-based Systems (CU27)
  • Microsoft SQL Server 2025 for x64-based Systems (CU9)

Security Updates (8)

Acknowledgments

Microsoft Red Team

Revision History

  • 2026-10-13: Information published.