CVE-2026-33120 Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network

Description

Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.

Affected products and versions

Product	Affected versions	Fixed in
Microsoft SQL Server 2022 (GDR) 16.0	16.0.0 → < 16.0.1175.1	16.0.1175.1

Other CVEs of Microsoft SQL Server 2022 (GDR)

The 196 CVEs of Microsoft SQL Server 2022 (GDR) →

CVE-2026-94512 Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network 8.8 High CVE-2026-94520 Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network 4.9 Medium CVE-2026-85919 Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally 7.0 High CVE-2026-88088 Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally 7.0 High