{"id":"CVE-2026-77488","aliases":[],"cve":{"records":[{"id":"CVE-2026-77488","source":"microsoft","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-08-20T20:11:33.672Z","published":"2026-09-08T17:18:17.166Z","modified":"2026-10-30T21:56:32.279Z"}],"publishers":[{"name":"microsoft","role":"CNA","organizationId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","modified":"2026-10-30T21:56:32.279Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-09-08T20:04:39.079Z"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77488","tags":["vendor-advisory","patch"],"source":"microsoft"}],"weaknesses":[{"id":"CWE-191","description":"CWE-191: Integer Underflow (Wrap or Wraparound)","source":"microsoft"}],"applicability":[{"source":"microsoft","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sql_server_2025:*:*:*:*:*:*:x64:*","versionStartIncluding":"17.0.0.0","versionEndExcluding":"17.0.4085.5"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sql_server_2022:*:*:*:*:*:*:x64:*","versionStartIncluding":"16.0.0.0","versionEndExcluding":"16.0.4275.2"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sql_server_2017:*:-:*:*:*:*:x64:*","versionStartIncluding":"14.0.0","versionEndExcluding":"14.0.2130.4"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sql_server_2019:*:*:*:*:*:*:x64:*","versionStartIncluding":"15.0.0","versionEndExcluding":"15.0.2190.7"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sql_server_2017:*:-:*:*:*:*:x64:*","versionStartIncluding":"14.0.0","versionEndExcluding":"14.0.3550.4"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sql_server_2022:*:*:*:*:*:*:x64:*","versionStartIncluding":"16.0.0","versionEndExcluding":"16.0.1200.5"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sql_server_2025:*:*:*:*:*:*:x64:*","versionStartIncluding":"17.0.1050.2","versionEndExcluding":"17.0.1135.8"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sql_server_2019:*:*:*:*:*:*:x64:*","versionStartIncluding":"15.0.0.0","versionEndExcluding":"15.0.4490.9"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-09-08T19:44:09.089579Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Microsoft SQL Server Information Disclosure Vulnerability","titleSource":"microsoft","descriptionSource":"microsoft","description":"Integer underflow (wrap or wraparound) in SQL Server allows an authorized attacker to disclose information locally.","score":5.5,"severity":"medium","published":"2026-09-08T17:18:17.166Z","modified":"2026-10-30T21:56:32.279Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Microsoft","name":"Microsoft SQL Server 2017 (CU 31)","platforms":["x64-based Systems"],"versions":[{"version":"14.0.0","status":"affected","lessThan":"14.0.3550.4","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-77488"},{"vendor":"Microsoft","name":"Microsoft SQL Server 2017 (GDR)","platforms":["x64-based Systems"],"versions":[{"version":"14.0.0","status":"affected","lessThan":"14.0.2130.4","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-77488"},{"vendor":"Microsoft","name":"Microsoft SQL Server 2019 (CU 32)","platforms":["x64-based Systems"],"versions":[{"version":"15.0.0.0","status":"affected","lessThan":"15.0.4490.9","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-77488"},{"vendor":"Microsoft","name":"Microsoft SQL Server 2019 (GDR)","platforms":["x64-based Systems"],"versions":[{"version":"15.0.0","status":"affected","lessThan":"15.0.2190.7","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-77488"},{"vendor":"Microsoft","name":"Microsoft SQL Server 2022 (CU 26)","platforms":["x64-based Systems"],"versions":[{"version":"16.0.0.0","status":"affected","lessThan":"16.0.4275.2","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-77488"},{"vendor":"Microsoft","name":"Microsoft SQL Server 2022 (GDR)","platforms":["x64-based Systems"],"versions":[{"version":"16.0.0","status":"affected","lessThan":"16.0.1200.5","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-77488"},{"vendor":"Microsoft","name":"Microsoft SQL Server 2025 (CU8)","platforms":["x64-based Systems"],"versions":[{"version":"17.0.0.0","status":"affected","lessThan":"17.0.4085.5","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-77488"},{"vendor":"Microsoft","name":"Microsoft SQL Server 2025 for x64-based Systems (GDR)","platforms":["x64-based Systems"],"versions":[{"version":"17.0.1050.2","status":"affected","lessThan":"17.0.1135.8","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-77488"}],"remediation":[],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77488"],"sources":[{"name":"CVE","id":"CVE-2026-77488","modified":"2026-10-30T21:56:32.279Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-77488"}],"assessments":[{"source":"microsoft","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","score":5.5}],"sourceAffected":[],"observedAt":"2026-10-30T22:45:53.011Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T12:05:31.745Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-31T04:15:34.043Z","attemptedAt":"2026-10-31T04:15:34.043Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-31T04:15:34.672Z","attemptedAt":"2026-10-31T04:15:34.672Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-31T04:15:33.990Z","attemptedAt":"2026-10-31T04:15:33.990Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-31T04:15:34.115Z","attemptedAt":"2026-10-31T04:15:34.115Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-73789","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-73789","modified":"Oct 30, 2026, 9:56:32 PM","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","checkedAt":"2026-10-31T04:15:33.990Z"},{"source":"NVD","id":"CVE-2026-77488","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77488","modified":"2026-09-15T14:57:29.537","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-10-31T04:15:34.043Z"},{"source":"FIRST EPSS","id":"CVE-2026-77488","url":"https://www.first.org/epss/","probability":0.00404,"percentile":0.3466,"date":"2026-10-30","checkedAt":"2026-10-31T04:15:34.115Z"},{"source":"GitHub Advisory Database","id":"GHSA-2p2q-6jp7-fc7g","url":"https://github.com/advisories/GHSA-2p2q-6jp7-fc7g","modified":"2026-09-08T18:33:54Z","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-10-31T04:15:34.672Z"}],"aiSummary":{"text":"Microsoft SQL Server has an integer underflow vulnerability, allowing an authorized attacker to disclose information locally, affecting versions 2017, 2019, 2022, and 2025. The weakness is due to integer underflow (wrap or wraparound).","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T01:01:11.869Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-77488"}]}}