CVE-2026-88081: Microsoft SQL Server Information Disclosure Vulnerability
Microsoft SQL Server Information Disclosure Vulnerability
Other sources
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.0.1145.4Patch KB5128492 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.1210.3Patch KB5128493 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.4305.5Patch KB5126934 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.0.5015.4Patch KB5126967 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.0.2140.2Patch KB5128497 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.0.4500.2Patch KB5128494 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.0.2200.2Patch KB5128495 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.0.3560.2Patch KB5128496
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authorized and able to reach the SQL Server instance over the network. No user interaction is required, and the attack complexity is rated low.
What is the expected impact if exploitation succeeds?
The stated impact is disclosure of information through an out-of-bounds read. Confidentiality impact is rated high, while integrity and availability impacts are rated none; the scope is changed.
Which SQL Server deployments should be assessed?
The affected software list includes Microsoft SQL Server 2017, 2019, 2022, and 2025, including SQL Server 2022 CU27 and SQL Server 2025 CU8 and CU9. The provided data does not state whether other cumulative updates or configurations are affected.