CVE-2026-94520
Awaiting Analysis Awaiting Analysis - Queue

Use of Externally-Controlled Format String in SQL Server

Publication date: 2026-10-13

Last updated on: 2026-10-15

Assigner: Microsoft Corporation

Description
Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-14
EPSS Evaluated
2026-10-18
NVD
CVE-2026-94520

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
Microsoft Microsoft SQL Server 2017 (GDR) 14.0.0
Microsoft Microsoft SQL Server 2017 for x64-based Systems (CU31) 14.0.3006.16
Microsoft Microsoft SQL Server 2019 (GDR) 15.0.0
Microsoft Microsoft SQL Server 2019 for x64-based Systems (CU32) 15.0.4003.23
Microsoft Microsoft SQL Server 2022 (GDR) 16.0.0
Microsoft Microsoft SQL Server 2022 for x64-based Systems (CU27) 16.0.4003.1
Microsoft Microsoft SQL Server 2025 for x64-based Systems (CU9) 17.0.4006.2
Microsoft Microsoft SQL Server 2025 for x64-based Systems (GDR) 17.0.1050.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-134 The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a format string issue in SQL Server where an authorized attacker can exploit externally-controlled input to cause a denial of service over a network. The flaw allows manipulation of SQL Server operations through crafted input, potentially crashing the system or disrupting services.

Impact Analysis

If exploited, this vulnerability could lead to service disruption for SQL Server databases, causing downtime and loss of access to critical data. Authorized users with network access may trigger crashes, affecting database availability and performance.

Mitigation Strategies

Apply the latest cumulative updates (CU) or general distribution release (GDR) patches for your SQL Server version to address the format string vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94520. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart