FAIL › dossier
sql server 2025
PRODUCT· dossier confidence 20%
Microsoft SQL Server 2025 is an enterprise database product from Microsoft that suffered a critical cluster of remote code execution, buffer overflow, and deserialization vulnerabilities in September 2026, requiring immediate patching and architectural review.
PROFILE
CategoryEnterprise DatabaseWhat they doMicrosoft SQL Server 2025 is an enterprise relational database management system from Microsoft.
Websitehttps://www.microsoft.com/sql-server ↗
SECURITY POSTURE
The product has a critical cluster of remote code execution, buffer overflow, and deserialization vulnerabilities discovered in September 2026, indicating severe degradation in its security posture.
Notable failures
- CVE-2026-67636: Out-of-bounds read RCE
- CVE-2026-67643: Heap-based buffer overflow RCE
- CVE-2026-67631: Heap-based buffer overflow RCE
- CVE-2026-67378: Untrusted pointer dereference RCE
- CVE-2026-54117: Deserialization of untrusted data RCE
- CVE-2026-54118: Deserialization of untrusted data RCE
Patterns: repeated critical RCEs in September 2026; heap-based buffer overflows; deserialization of untrusted data; out-of-bounds read vulnerabilities
FAILURE HISTORY · 6
| DATE | EVENT | SEV | SUMMARY |
|---|---|---|---|
| 2026-09-08 | CVE-2026-67643 | critical | A heap-based buffer overflow in Microsoft SQL Server allows remote code execution over a network. |
| 2026-09-08 | CVE-2026-67631 | critical | A heap-based buffer overflow in Microsoft SQL Server allows remote code execution over a network. |
| 2026-09-08 | CVE-2026-67378 | critical | CVE-2026-67378 is an untrusted pointer dereference in Microsoft SQL Server allowing remote code execution over a network. |
| 2026-09-08 | CVE-2026-67636 | critical | An out-of-bounds read vulnerability in SQL Server allows remote code execution over a network. |
| 2026-07-14 | CVE-2026-54117 | critical | CVE-2026-54117: Deserialization of untrusted data in SQL Server allows an unauthorized attacker |
| 2026-07-14 | CVE-2026-54118 | critical | CVE-2026-54118: Deserialization of untrusted data in SQL Server allows an unauthorized attacker |
DOSSIER SOURCES
- Microsoft (MSFT) Company Profile & Description - Stock Analysis · stockanalysis.com
- Microsoft Corporation (MSFT) Company Profile - Business Overview ... · stocknear.com
- MSFT - Microsoft Corporation Company Profile · stockinvest.us
- Latest SQL Server Updates & Patches | Builds, KBs, CUs & GDRs · kerteszmihaly.com
- SupportArticles-docs/support/sql/releases/sqlserver-2025/build ... - GitHub · github.com
- SQL Server | Microsoft Community Hub · techcommunity.microsoft.com
- SupportArticles-docs/support/sql/releases/sqlserver-2025/build ... - GitHub · github.com
- KB5122048 - Cumulative Update 9 for SQL Server 2025 · support.microsoft.com
- SQL Server 2025 建置版本（KB5005684） - SQL Server | Microsoft Learn · learn.microsoft.com
Open questions: exact release date of SQL Server 2025 · specific patch timeline for September 2026 vulnerabilities
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-18 04:26:06.167525+00:00