CVE-2026-67629: Microsoft SQL Server Information Disclosure Vulnerability

The operational point for database administrators is straightforward: this is a network-reachable information-disclosure issue with a low attack-complexity rating, but it requires attacker privileges. Microsoft’s remediation is build-specific, so patch compliance needs to verify the installed SQL Server servicing branch and resulting build number rather than treating one KB as a universal fix.

Microsoft’s Security Response Center describes the issue as: “SQL Server Information Disclosure Vulnerability: Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.” The advisory’s specific impact statement says that an attacker who successfully exploited the vulnerability could potentially read portions of process memory.

CVE-2026-67629 severity and exposure conditions​

CVE-2026-67629 is rated Important with a CVSS base score of 6.5 and a temporal score of 5.7. Its complete CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C.

The vector describes a vulnerability reachable over the network with low attack complexity and no user interaction. The PR:L component is a meaningful boundary: an attacker must be authorized, rather than being an unauthenticated internet client. The score also assigns High impact to confidentiality, while integrity and availability are marked as having no impact. In practical terms, the advisory is about unauthorized reading of data in process memory, not modification of SQL Server data or service disruption.

Microsoft classifies the underlying weakness as CWE-125, an out-of-bounds read. That category covers software reading memory outside the intended bounds of a buffer or data structure. In this advisory, Microsoft’s stated consequence is exposure of portions of process memory.

Publicly disclosed: No

Exploited: No

Customer action required: Yes

Microsoft’s exploitation assessment is Exploitation Unlikely. That assessment should inform prioritization, but it does not remove the patch requirement: a low-likelihood assessment is not a mitigation, and the vulnerability remains network-accessible to an authorized attacker.

The CU and GDR split determines the correct update​

The affected products span SQL Server 2017 through SQL Server 2025, with separate packages for the listed cumulative-update and GDR branches. Administrators must use the package matching their deployed servicing track. Applying the wrong branch’s update is not the same as reaching the fixed build specified by Microsoft.

The separate CU and GDR entries are important for inventory and change-control work. A patch report that records only “SQL Server 2019” or “SQL Server 2022” lacks enough detail to establish remediation for this CVE. The relevant evidence is the product’s named branch plus the fixed build Microsoft specifies.

Microsoft’s prescribed remediation​

For Microsoft SQL Server 2017 for x64-based Systems (CU 31), install KB5122774 to reach fixed build 14.0.3550.4. For Microsoft SQL Server 2017 for x64-based Systems (GDR), install KB5122775 to reach fixed build 14.0.2130.4.

For Microsoft SQL Server 2019 for x64-based Systems (CU 32), install KB5122772 to reach fixed build 15.0.4490.9. For Microsoft SQL Server 2019 for x64-based Systems (GDR), install KB5122773 to reach fixed build 15.0.2190.7.

For Microsoft SQL Server 2022 for x64-based Systems (CU 26), install KB5122768 to reach fixed build 16.0.4275.2. For Microsoft SQL Server 2022 for x64-based Systems (GDR), install KB5122771 to reach fixed build 16.0.1200.5.

For Microsoft SQL Server 2025 for x64-based Systems (CU8), install KB5122769 to reach fixed build 17.0.4085.5. For Microsoft SQL Server 2025 for x64-based Systems (GDR), install KB5122770 to reach fixed build 17.0.1135.8.

Microsoft’s advisory does not frame these as optional configuration changes or workarounds; its customer-action status requires action. The specified KB and corresponding build should therefore be the closure criteria for each affected SQL Server instance.

What administrators should validate after deployment​

The immediate task is to identify every instance that matches one of the eight affected product-and-servicing-track combinations, deploy the matching update, and verify that the instance reaches its stated fixed build. Because the CVE concerns disclosure of process memory to an authorized attacker, environments that grant SQL Server access across application tiers, reporting systems, automation accounts, or delegated administrative workflows should ensure those instances are included in patch inventory.

The vulnerability’s CVSS characteristics make the privilege requirement worth examining alongside patch deployment. PR:L means access control still places a barrier in front of exploitation, but it is not a substitute for installing the update. Microsoft’s own description explicitly contemplates an authorized attacker, so organizations should avoid equating “authorized” with “trusted” when determining urgency.

For SQL Server teams using CU servicing, the relevant fixed versions are 14.0.3550.4, 15.0.4490.9, 16.0.4275.2, and 17.0.4085.5. For the listed GDR servicing products, the required fixed versions are 14.0.2130.4, 15.0.2190.7, 16.0.1200.5, and 17.0.1135.8. Those exact versions provide the concrete post-installation test for CVE-2026-67629 remediation.