Sql Server 2022 (Microsoft) - vulnerabilities (CVEs)

188 CVEs, 21 in the last 30 days, 77 known versions, newest CVE from 2026-10-13. Vendor: Microsoft.

CVEs of Sql Server 2022

CVE-2026-94520 - CVSS 4.9 (medium), 2026-10-13: Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.
CVE-2026-94512 - CVSS 8.8 (high), 2026-10-13: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-88086 - CVSS 5.3 (medium), 2026-10-13: Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over an adjacent network.
CVE-2026-88085 - CVSS 6.4 (medium), 2026-10-13: Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.
CVE-2026-88089 - CVSS 6.7 (medium), 2026-10-13: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
CVE-2026-85919 - CVSS 7 (high), 2026-10-13: Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.
CVE-2026-88088 - CVSS 7 (high), 2026-10-13: Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally.
CVE-2026-85888 - CVSS 7.7 (high), 2026-10-13: Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-88082 - CVSS 7 (high), 2026-10-13: Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.
CVE-2026-88081 - CVSS 7.7 (high), 2026-10-13: Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-88083 - CVSS 7.5 (high), 2026-10-13: Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
CVE-2026-65674 - CVSS 8.8 (high), 2026-10-13: Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-67628 - CVSS 4.9 (medium), 2026-10-13: Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-67626 - CVSS 6.5 (medium), 2026-10-13: Uncontrolled resource consumption in SQL Server allows an authorized attacker to deny service over a network.
CVE-2026-85876 - CVSS 7 (high), 2026-10-13: Use after free in SQL Server allows an authorized attacker to elevate privileges locally.
CVE-2026-83945 - CVSS 6.6 (medium), 2026-10-13: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-70189 - CVSS 6.7 (medium), 2026-10-13: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
CVE-2026-85886 - CVSS 8.5 (high), 2026-10-13: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-68883 - CVSS 8.5 (high), 2026-10-13: Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-67625 - CVSS 8.5 (high), 2026-10-13: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-96956 - CVSS 8 (high), 2026-10-13: Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-77481 - CVSS 8.8 (high), 2026-09-08: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-67645 - CVSS 6.5 (medium), 2026-09-08: Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-67624 - CVSS 6.5 (medium), 2026-09-08: Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-66819 - CVSS 8.8 (high), 2026-09-08: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a…
CVE-2026-78456 - CVSS 8.8 (high), 2026-09-08: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-77488 - CVSS 5.5 (medium), 2026-09-08: Integer underflow (wrap or wraparound) in SQL Server allows an authorized attacker to disclose information locally.
CVE-2026-77485 - CVSS 7 (high), 2026-09-08: Use after free in SQL Server allows an authorized attacker to elevate privileges locally.
CVE-2026-77487 - CVSS 8.8 (high), 2026-09-08: Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-77484 - CVSS 8.8 (high), 2026-09-08: Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-77483 - CVSS 8.8 (high), 2026-09-08: Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-77480 - CVSS 8.8 (high), 2026-09-08: Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-73028 - CVSS 8.8 (high), 2026-09-08: Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-47297 - CVSS 8.1 (high), 2026-09-08: Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
CVE-2026-68780 - CVSS 6.5 (medium), 2026-09-08: Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-68779 - CVSS 6.5 (medium), 2026-09-08: Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-68778 - CVSS 6.5 (medium), 2026-09-08: Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-68777 - CVSS 6.5 (medium), 2026-09-08: Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-68776 - CVSS 6.5 (medium), 2026-09-08: Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-67648 - CVSS 6.5 (medium), 2026-09-08: Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-68775 - CVSS 8.8 (high), 2026-09-08: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-67641 - CVSS 6.5 (medium), 2026-09-08: Integer overflow or wraparound in SQL Server allows an authorized attacker to deny service over a network.
CVE-2026-67639 - CVSS 8.8 (high), 2026-09-08: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-67393 - CVSS 6.5 (medium), 2026-09-08: Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-67388 - CVSS 8.8 (high), 2026-09-08: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-67390 - CVSS 6.5 (medium), 2026-09-08: Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-67385 - CVSS 8.8 (high), 2026-09-08: Use after free in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-67386 - CVSS 6.5 (medium), 2026-09-08: Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-67380 - CVSS 8.8 (high), 2026-09-08: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-67381 - CVSS 8.8 (high), 2026-09-08: Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-66818 - CVSS 8.8 (high), 2026-09-08: Improper privilege management in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-66820 - CVSS 8.8 (high), 2026-09-08: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a…
CVE-2026-66814 - CVSS 8.8 (high), 2026-09-08: Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-66816 - CVSS 6.5 (medium), 2026-09-08: Insufficient logging in SQL Server allows an authorized attacker to bypass a security feature over a network.
CVE-2026-73029 - CVSS 6.5 (medium), 2026-09-08: Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-68786 - CVSS 8.8 (high), 2026-09-08: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-67643 - CVSS 9.8 (critical), 2026-09-08: Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
CVE-2026-67636 - CVSS 9 (critical), 2026-09-08: Out-of-bounds read in SQL Server allows an unauthorized attacker to execute code over a network.
CVE-2026-67389 - CVSS 6.5 (medium), 2026-09-08: Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-67384 - CVSS 8.8 (high), 2026-09-08: Integer overflow or wraparound in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-67376 - CVSS 7.5 (high), 2026-09-08: Integer overflow or wraparound in SQL Server allows an unauthorized attacker to deny service over a network.
CVE-2026-67379 - CVSS 8.5 (high), 2026-09-08: Stack-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-67378 - CVSS 9 (critical), 2026-09-08: Untrusted pointer dereference in SQL Server allows an unauthorized attacker to execute code over a network.
CVE-2026-68785 - CVSS 4.9 (medium), 2026-09-08: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-68787 - CVSS 7.8 (high), 2026-09-08: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
CVE-2026-68784 - CVSS 6.5 (medium), 2026-09-08: Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-67633 - CVSS 6.5 (medium), 2026-09-08: Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a network.
CVE-2026-68781 - CVSS 6.5 (medium), 2026-09-08: Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-67631 - CVSS 9.8 (critical), 2026-09-08: Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
CVE-2026-67630 - CVSS 6.5 (medium), 2026-09-08: Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-67629 - CVSS 6.5 (medium), 2026-09-08: Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-67370 - CVSS 8.8 (high), 2026-09-08: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a…
CVE-2026-67368 - CVSS 8.8 (high), 2026-09-08: Improper link resolution before file access ('link following') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-47295 - CVSS 8.8 (high), 2026-07-14: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a…
CVE-2026-55002 - CVSS 8.8 (high), 2026-07-14: External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-54118 - CVSS 9.8 (critical), 2026-07-14: Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
CVE-2026-54117 - CVSS 9.8 (critical), 2026-07-14: Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
CVE-2026-47296 - CVSS 7.5 (high), 2026-07-14: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a…
CVE-2026-40370 - CVSS 8.8 (high), 2026-05-12: External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-33120 - CVSS 8.8 (high), 2026-04-14: Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-32176 - CVSS 7.8 (high), 2026-04-14: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
CVE-2026-32167 - CVSS 7.8 (high), 2026-04-14: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
CVE-2026-26116 - CVSS 8.8 (high), 2026-03-10: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a…
CVE-2026-26115 - CVSS 8.8 (high), 2026-03-10: Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-21262 - CVSS 8.8 (high), 2026-03-10: Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-20803 - CVSS 7.2 (high), 2026-01-13: Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2025-59499 - CVSS 8.8 (high), 2025-11-11: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a…
CVE-2025-55227 - CVSS 8.8 (high), 2025-09-09: Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate privileges over a…
CVE-2025-47997 - CVSS 6.5 (medium), 2025-09-09: Concurrent execution using shared resource with improper synchronization ('race condition') in SQL Server allows an authorized attacker to disclose…
CVE-2025-53727 - CVSS 8.8 (high), 2025-08-12: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a…
CVE-2025-49759 - CVSS 8.8 (high), 2025-08-12: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a…
CVE-2025-49758 - CVSS 8.8 (high), 2025-08-12: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a…
CVE-2025-47954 - CVSS 8.8 (high), 2025-08-12: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a…
CVE-2025-24999 - CVSS 8.8 (high), 2025-08-12: Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2025-49717 - CVSS 8.5 (high), 2025-07-08: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVE-2025-49719 - CVSS 7.5 (high), 2025-07-08: Improper input validation in SQL Server allows an unauthorized attacker to disclose information over a network.
CVE-2025-49718 - CVSS 7.5 (high), 2025-07-08: Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network.
CVE-2024-49043 - CVSS 7.8 (high), 2024-11-12: Microsoft.SqlServer.XEvent.Configuration.dll Remote Code Execution Vulnerability
CVE-2024-49021 - CVSS 7.8 (high), 2024-11-12: Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2024-37966 - CVSS 7.1 (high), 2024-09-10: Microsoft SQL Server Native Scoring Information Disclosure Vulnerability