Microsoft’s advisory describes an out-of-bounds read in SQL Server that allows an authorized attacker to deny service over a network. The flaw is rated Important with a CVSS base score of 6.5 and a temporal score of 5.7. Its CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C; in practical terms, the scoring reflects network reachability, low attack complexity, a requirement for existing low-level privileges, no user interaction, and an availability impact rather than a confidentiality or integrity impact.
Microsoft’s official advisory identifies the weakness as CWE-125, an out-of-bounds read. The vendor’s published description is specific about the consequence: “Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a network.” It does not describe a path to data exposure, data alteration, or code execution in the supplied advisory record.
Microsoft’s advisory status for CVE-2026-67633
Microsoft published CVE-2026-67633 on September 8, 2026. The vendor’s formal advisory fact is: “SQL Server Denial of Service Vulnerability: Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a network.”
Publicly disclosed: No
Exploited: No
Customer action required: Yes
Microsoft’s exploitation assessment is Exploitation Unlikely. That assessment should inform prioritization, but it does not remove the patching requirement: an authenticated network-accessible denial-of-service issue can still interrupt database availability where SQL Server accounts are broadly provisioned or where an attacker has already obtained valid credentials.
The affected set covers both CU and GDR servicing branches for each listed SQL Server generation. This split is operationally important. CU and GDR installations must be maintained with their respective update stream, so inventory needs to capture both the major SQL Server release and the branch currently deployed before a change window is scheduled.
Fixed builds for SQL Server 2017 and SQL Server 2019
Microsoft lists two remediation routes for Microsoft SQL Server 2017 for x64-based Systems. For Microsoft SQL Server 2017 for x64-based Systems (CU 31), install KB5122774 to reach fixed build 14.0.3550.4. For Microsoft SQL Server 2017 for x64-based Systems (GDR), install KB5122775 to reach fixed build 14.0.2130.4.
The same CU-versus-GDR distinction applies to Microsoft SQL Server 2019 for x64-based Systems. For Microsoft SQL Server 2019 for x64-based Systems (CU 32), install KB5122772 to reach fixed build 15.0.4490.9. For Microsoft SQL Server 2019 for x64-based Systems (GDR), install KB5122773 to reach fixed build 15.0.2190.7.
The build target is the useful verification point after deployment. A change record that says only that “the September update” was installed leaves too much ambiguity when multiple servicing branches exist. For this CVE, the relevant post-update values are 14.0.3550.4 or 14.0.2130.4 for the applicable SQL Server 2017 branch, and 15.0.4490.9 or 15.0.2190.7 for the applicable SQL Server 2019 branch.
Fixed builds for SQL Server 2022 and SQL Server 2025
For Microsoft SQL Server 2022 for x64-based Systems (CU 26), Microsoft directs customers to install KB5122768 to reach fixed build 16.0.4275.2. For Microsoft SQL Server 2022 for x64-based Systems (GDR), install KB5122771 to reach fixed build 16.0.1200.5.
Microsoft SQL Server 2025 for x64-based Systems is also affected in both servicing lines. For Microsoft SQL Server 2025 for x64-based Systems (CU8), install KB5122769 to reach fixed build 17.0.4085.5. For Microsoft SQL Server 2025 for x64-based Systems (GDR), install KB5122770 to reach fixed build 17.0.1135.8.
These are separate product-and-build mappings, not interchangeable alternatives. The exact remediation record supplied by Microsoft is:
| Affected product | Required update | Fixed build |
|---|---|---|
| Microsoft SQL Server 2017 for x64-based Systems (CU 31) | KB5122774 | 14.0.3550.4 |
| Microsoft SQL Server 2017 for x64-based Systems (GDR) | KB5122775 | 14.0.2130.4 |
| Microsoft SQL Server 2019 for x64-based Systems (CU 32) | KB5122772 | 15.0.4490.9 |
| Microsoft SQL Server 2019 for x64-based Systems (GDR) | KB5122773 | 15.0.2190.7 |
| Microsoft SQL Server 2022 for x64-based Systems (CU 26) | KB5122768 | 16.0.4275.2 |
| Microsoft SQL Server 2022 for x64-based Systems (GDR) | KB5122771 | 16.0.1200.5 |
| Microsoft SQL Server 2025 for x64-based Systems (CU8) | KB5122769 | 17.0.4085.5 |
| Microsoft SQL Server 2025 for x64-based Systems (GDR) | KB5122770 | 17.0.1135.8 |
The patching decision is branch-specific
CVE-2026-67633 is a denial-of-service vulnerability, so the immediate risk is service availability. Organizations using SQL Server for line-of-business applications, reporting workloads, or other systems that depend on continuous database access should treat the update as a maintenance task requiring validation against the correct servicing branch rather than as a generic SQL Server patch.
For Microsoft SQL Server 2017 for x64-based Systems (CU 31), install KB5122774 to reach fixed build 14.0.3550.4. For Microsoft SQL Server 2017 for x64-based Systems (GDR), install KB5122775 to reach fixed build 14.0.2130.4. For Microsoft SQL Server 2019 for x64-based Systems (CU 32), install KB5122772 to reach fixed build 15.0.4490.9. For Microsoft SQL Server 2019 for x64-based Systems (GDR), install KB5122773 to reach fixed build 15.0.2190.7.
For Microsoft SQL Server 2022 for x64-based Systems (CU 26), install KB5122768 to reach fixed build 16.0.4275.2. For Microsoft SQL Server 2022 for x64-based Systems (GDR), install KB5122771 to reach fixed build 16.0.1200.5. For Microsoft SQL Server 2025 for x64-based Systems (CU8), install KB5122769 to reach fixed build 17.0.4085.5. For Microsoft SQL Server 2025 for x64-based Systems (GDR), install KB5122770 to reach fixed build 17.0.1135.8.
The actionable outcome is clear: match every affected SQL Server instance to its CU or GDR entry, deploy the corresponding KB, and verify that the instance reaches Microsoft’s stated fixed build.