CVE-2026-88088
7.0HighPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-190
Impact
An attacker with local or low-privileged database access can elevate privileges to take full control of the SQL Server instance or host. Exploitation requires existing local authentication and specific conditions to trigger the flaw.
Root cause
An integer overflow or wraparound condition in SQL Server allows improper memory handling and privilege escalation.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Apply the official security update from Microsoft for your SQL Server version. Restrict local access and database permissions to authorized users until the patch is deployed.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally.