CVE-2026-33120
Untrusted Pointer Dereference in SQL Server Enables Remote Code Execution
Publication date: 2026-04-14
Last updated on: 2026-05-06
Assigner: Microsoft Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| microsoft | sql_server_2016 | From 13.0.6300.2 (inc) to 13.0.6485.1 (exc) |
| microsoft | sql_server_2016 | From 13.0.7000.253 (inc) to 13.0.7080.1 (exc) |
| microsoft | sql_server_2017 | From 14.0.1000.169 (inc) to 14.0.2105.1 (exc) |
| microsoft | sql_server_2017 | From 14.0.3006.16 (inc) to 14.0.3525.1 (exc) |
| microsoft | sql_server_2019 | From 15.0.2000.5 (inc) to 15.0.2165.1 (exc) |
| microsoft | sql_server_2019 | From 15.0.4003.23 (inc) to 15.0.4465.1 (exc) |
| microsoft | sql_server_2022 | From 16.0.1000.6 (inc) to 16.0.1175.1 (exc) |
| microsoft | sql_server_2022 | From 16.0.4003.1 (inc) to 16.0.4250.1 (exc) |
| microsoft | sql_server_2025 | From 17.0.1000.7 (inc) to 17.0.1110.1 (exc) |
| microsoft | sql_server_2025 | From 17.0.4006.2 (inc) to 17.0.4030.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-822 | The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves an untrusted pointer dereference in Microsoft SQL Server. It allows an authorized attacker to execute code remotely over a network.
How can this vulnerability impact me? :
An attacker with authorized access could exploit this vulnerability to execute arbitrary code on the affected SQL Server remotely. This could lead to full compromise of the server, including unauthorized data access, data modification, or disruption of availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an authorized attacker to execute code remotely on SQL Server, which could lead to unauthorized access, data breaches, or data integrity issues.
Such security breaches can impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and maintaining system integrity.
However, the provided information does not explicitly detail the direct effects on compliance with these standards.