AI and data stack advisories

Severe, 6 weeks977Projects326

977 severe, 6 weeks · 326 projects

MicrosoftCVE-2026-65674

Microsoft SQL Server: unsafe deserialization

Microsoft

CVE-2026-65674 · Published Oct 13, 2026 · updated Nov 2, 2026

High8.8
Fix: upgrade to 15.0.2200.2 or later (6 fixed versions below)
Microsoft advisory

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.

Affected versions

PackageAffectedFixed in
Microsoft SQL Server 2019 (GDR)
Product
>= 15.0.0, < 15.0.2200.215.0.2200.2
Microsoft SQL Server 2019 for x64-based Systems (CU32)
Product
>= 15.0.4003.23, < 15.0.4500.215.0.4500.2
Microsoft SQL Server 2022 (GDR)
Product
>= 16.0.0, < 16.0.1210.316.0.1210.3
Microsoft SQL Server 2022 for x64-based Systems (CU27)
Product
>= 16.0.4003.1, < 16.0.4305.516.0.4305.5
Microsoft SQL Server 2025 for x64-based Systems (CU9)
Product
>= 17.0.4006.2, < 17.0.5015.417.0.5015.4
Microsoft SQL Server 2025 for x64-based Systems (GDR)
Product
>= 17.0.1050.2, < 17.0.1145.417.0.1145.4
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-502

More Microsoft advisories

All Microsoft
High 8.0Oct 13Microsoft SQL Server: stack buffer overflowCVE-2026-96956fixed in 14.0.2140.2 +7High 8.8Oct 13Microsoft SQL Server: heap buffer overflowCVE-2026-94512fixed in 14.0.2140.2 +7Medium 6.4Oct 13Microsoft SQL Server: heap buffer overflowCVE-2026-88085fixed in 14.0.2140.2 +7Medium 5.3Oct 13Microsoft SQL Server: out-of-bounds readCVE-2026-88086fixed in 15.0.2200.2 +5High 7.0Oct 13Microsoft SQL Server: integer overflowCVE-2026-88088fixed in 15.0.2200.2 +5Medium 6.7Oct 13Microsoft SQL Server: heap buffer overflowCVE-2026-88089fixed in 14.0.2140.2 +7