CVE-2026-88088
Full vulnerability record from the local CVENow database.
Description
Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally.
Severity
HIGH
CVSS score
7.0
(v3.1)
Vulnerability status
Undergoing Analysis
Source identifier
Published
2026-10-13 21:19:43.307000
Last modified
2026-10-30 20:17:23.730000
View original CVE JSON
{
"id": "CVE-2026-88088",
"sourceIdentifier": "[email protected]",
"published": "2026-10-13T21:19:43.307",
"lastModified": "2026-10-30T20:17:23.730",
"vulnStatus": "Undergoing Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2019 (GDR)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "15.0.0",
"lessThan": "15.0.2200.2",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2019 for x64-based Systems (CU32)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "15.0.4003.23",
"lessThan": "15.0.4500.2",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2022 (GDR)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "16.0.0",
"lessThan": "16.0.1210.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2022 for x64-based Systems (CU27)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "16.0.4003.1",
"lessThan": "16.0.4305.5",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2025 for x64-based Systems (CU9)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "17.0.4006.2",
"lessThan": "17.0.5015.4",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2025 for x64-based Systems (GDR)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "17.0.1050.2",
"lessThan": "17.0.1145.4",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.0,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-15T00:00:00+00:00",
"id": "CVE-2026-88088",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-190"
}
]
}
],
"references": [
{
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88088",
"source": "[email protected]"
}
]
}