CVE-2026-33120
Published: 14 April 2026
Summary
CVE-2026-33120 is a high-severity Untrusted Pointer Dereference (CWE-822) vulnerability in Microsoft Sql Server 2016. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 22.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Mandates timely remediation of known flaws like the untrusted pointer dereference in SQL Server through patching as recommended by Microsoft.
Deploys memory protection mechanisms such as ASLR and DEP to prevent successful exploitation of pointer dereference vulnerabilities leading to arbitrary code execution.
Limits privileges of authorized low-privilege users accessing SQL Server over the network, reducing the attack surface for this vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote authenticated RCE via memory corruption (untrusted pointer dereference) in SQL Server directly enables exploitation of a network-accessible service for code execution and privilege escalation from low-privileged accounts.
NVD Description
Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.
Deeper analysisAI
CVE-2026-33120 is an untrusted pointer dereference vulnerability (CWE-822) affecting Microsoft SQL Server. Published on 2026-04-14T18:17:34.420, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact across confidentiality, integrity, and availability.
An authorized attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low attack complexity and no user interaction required. Successful exploitation enables arbitrary code execution on the targeted SQL Server instance.
Microsoft has published an update guide addressing this vulnerability at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33120, which provides details on patches and mitigation steps.
Details
- CWE(s)