CVE-2026-67641: Microsoft SQL Server Denial of Service Vulnerability
Published Sep 8, 2026
·Updated
Integer overflow or wraparound in SQL Server allows an authorized attacker to deny service over a network.
Other sources
Microsoft SQL Server Denial of Service Vulnerability
— Microsoft
Affected Software
8 affected componentsFixes available
Microsoft SQL Server 2022 (CU 26)<16.0.4275.2
16.0.4275.2
Microsoft SQL Server 2025<17.0.1135.8
17.0.1135.8
Microsoft SQL Server 2025 (CU8)<17.0.4085.5
17.0.4085.5
Microsoft SQL Server 2022<16.0.1200.5
16.0.1200.5
Microsoft SQL Server 2022<16.0.1200.5
Microsoft SQL Server 2022>=16.0.4003.1<16.0.4275.2
Microsoft SQL Server 2025<17.0.1135.8
Microsoft SQL Server 2025>=17.0.4006.2<17.0.4085.5
Remediation
Event History
Sep 8, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·05:14 PM
Data Sourced
via MITRE·05:14 PM
DescriptionSeverity
Data Sourced
via NVD·06:18 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Who can exploit this vulnerability?
An attacker must be authorized and able to reach the SQL Server instance over the network. No user interaction is required.
2
What is the impact of successful exploitation?
Successful exploitation can deny service on the affected SQL Server instance. The provided information does not indicate confidentiality or integrity impact.
3
Which SQL Server releases are identified as affected?
The listed software includes Microsoft SQL Server 2022, SQL Server 2022 CU 26, SQL Server 2025, and SQL Server 2025 CU8.