CVE-2024-26191

Published: Sep 10, 2024Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: secure@microsoft.com (Secondary)

Description

Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability

Affected (8)

Products: Microsoft: Sql 2016 Azure Connect Feature Pack, Sql Server 2016, Sql Server 2017, Sql Server 2019, Sql Server 2022

5 products

Sql 2016 Azure Connect Feature Pack

Sql Server 2016

Sql Server 2017

Sql Server 2019

Sql Server 2022

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Microsoft Sql 2016 Azure Connect Feature Pack	From 13.0.7000.253 to 13.0.7037.1
Microsoft Sql Server 2016	From 13.0.6300.2 to 13.0.6441.1
Microsoft Sql Server 2017	From 14.0.1000.169 to 14.0.2060.1
Microsoft Sql Server 2017	From 14.0.3006.16 to 14.0.3475.1
Microsoft Sql Server 2019	From 15.0.2000.5 to 15.0.2120.1
Microsoft Sql Server 2019	From 15.0.4003.23 to 15.0.4390.2
Microsoft Sql Server 2022	From 16.0.1000.6 to 16.0.1125.1
Microsoft Sql Server 2022	From 16.0.4003.1 to 16.0.4140.3

Related CWEs

Heap-based Buffer Overflow

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26191

Source: secure@microsoft.com

PatchVendor Advisory

Timeline

No history available yet.