AI and data stack advisories

Severe, 6 weeks977Projects326

977 severe, 6 weeks · 326 projects

MicrosoftCVE-2026-85876

Microsoft SQL Server: use after free

Microsoft

CVE-2026-85876 · Published Oct 13, 2026 · updated Nov 2, 2026

High7.0
Fix: upgrade to 15.0.2200.2 or later (6 fixed versions below)
Microsoft advisory

Use after free in SQL Server allows an authorized attacker to elevate privileges locally.

Affected versions

PackageAffectedFixed in
Microsoft SQL Server 2019 (GDR)
Product
>= 15.0.0, < 15.0.2200.215.0.2200.2
Microsoft SQL Server 2019 for x64-based Systems (CU32)
Product
>= 15.0.4003.23, < 15.0.4500.215.0.4500.2
Microsoft SQL Server 2022 (GDR)
Product
>= 16.0.0, < 16.0.1210.316.0.1210.3
Microsoft SQL Server 2022 for x64-based Systems (CU27)
Product
>= 16.0.4003.1, < 16.0.4305.516.0.4305.5
Microsoft SQL Server 2025 for x64-based Systems (CU9)
Product
>= 17.0.4006.2, < 17.0.5015.417.0.5015.4
Microsoft SQL Server 2025 for x64-based Systems (GDR)
Product
>= 17.0.1050.2, < 17.0.1145.417.0.1145.4
Details and references
CVSS 3.1
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-416

More Microsoft advisories

All Microsoft
High 8.0Oct 13Microsoft SQL Server: stack buffer overflowCVE-2026-96956fixed in 14.0.2140.2 +7High 8.8Oct 13Microsoft SQL Server: heap buffer overflowCVE-2026-94512fixed in 14.0.2140.2 +7Medium 6.4Oct 13Microsoft SQL Server: heap buffer overflowCVE-2026-88085fixed in 14.0.2140.2 +7Medium 5.3Oct 13Microsoft SQL Server: out-of-bounds readCVE-2026-88086fixed in 15.0.2200.2 +5High 7.0Oct 13Microsoft SQL Server: integer overflowCVE-2026-88088fixed in 15.0.2200.2 +5Medium 6.7Oct 13Microsoft SQL Server: heap buffer overflowCVE-2026-88089fixed in 14.0.2140.2 +7