cve-2026-67633

CVE-2026-67633 is a Microsoft SQL Server denial of service vulnerability addressed in Microsoft's September 8 security release. The flaw is an out-of-bounds read that lets an authorized attacker deny service over a network, and Microsoft rates it Important with a CVSS base score of 6.5 and a temporal score of 5.7. Fixes cover supported SQL Server 2017, 2019, 2022, and 2025 servicing tracks, but administrators must determine whether each server follows the Cumulative Update or GDR path and install the matching KB, since fixed builds differ by branch and the wrong servicing line will not meet Microsoft's remediation target.