CVE-2019-1068

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2019-1068 8.8

Microsoft · SQL Server · Added 2026-08-26 · Published 2019-07-15

3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityMicrosoft SQL Server Remote Code Execution Vulnerability

VendorMicrosoft

ProductSQL Server

Date added2026-08-26

Due date2026-08-29

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to CISA's BOD 26-04 patching guidelines.

CWECWE-20

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.

NVD: A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-08-28 17:44 UTC

Searches3

Component defaultunknown

Sources https://medium.com/@fecassie/discovering-an-undisclosed-stack-overflow-vulnerability-in-microsoft-sql-server-cve-2019-1068-933b9df1a8b
https://0xsaiyajin.github.io/vulnerability-research/2021/02/06/discovering-an-undisclosed-stack-overflow-vulnerability-in-mssql-server-cve-2019-1068.html
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1068
https://github.com/Vulnerability-Playground/CVE-2019-1068
https://github.com/Vulnerability-Playground/CVE-2019-1068/blob/main/cve-2019-1068_DoS_PoC.py
https://support.microsoft.com/en-us/topic/kb4505224-description-of-the-security-update-for-sql-server-2017-gdr-july-9-2019-eef4d1c7-96db-cdce-eedd-ccc54d7fba45

QC notes

warn component_extraction: Component 'svl.dll internal function processing in SQL Server Database Engine' matches or contains product name 'SQL Server' — no specific component identified

Hunting hypothesis agent

Hunt SQL Server error logs for RESTORE FILELISTONLY FROM DISK='C\:AAA' via TDS/pyodbc — the short disk path overflows svl.dll crashing sqlservr.exe; stock logs capture the command but Extended Events are needed for TDS detail

Research details

Componentsvl.dll internal function processing in SQL Server Database Engine

PreconditionsNetwork-accessible SQL Server instance (port 1433) with valid low-privileged database credentials; target must run SQL Server 2014 SP2/SP3, 2016 SP1/SP2, or 2017; attacker needs ability to execute crafted SQL queries that reach the vulnerable svl.dll code path via TDS protocol agent

DeliveryCrafted SQL statement (RESTORE FILELISTONLY FROM DISK='C:AAA') sent via TDS protocol (pyodbc ODBC connection) to SQL Server instance; the short disk path triggers a stack buffer overflow in svl.dll internal function processing within the Database Engine, corrupting the return address on the stack.

Public PoCyes

PoC URLs https://github.com/Vulnerability-Playground/CVE-2019-1068 Third-party repos; verify before use.

Advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1068

Exploit notesCVSS attack complexity: LOW (AV:N/AC:L/PR:L/UI:N). The public PoC (Vulnerability-Playground/CVE-2019-1068) is DoS-only: it sends RESTORE FILELISTONLY FROM DISK='C:AAA' via pyodbc TDS connection; the 2-character disk path triggers a stack buffer overflow in svl.dll, crashing sqlservr.exe. No public RCE weaponization exists. APT41 was observed exploiting this in the wild (Mandiant, March 2020). Requires low-privileged SQL Server credentials (standard user with db_owner or similar); affects SQL Server 2014 SP2/SP3, 2016 SP1/SP2, and 2017. Stock SQL Server error logs record the RESTORE command text but not TDS-level detail; Extended Events or a TDS-aware tap is needed.

SummaryMicrosoft SQL Server versions 2014 through 2017 contain a stack overflow in svl.dll triggered by incorrect handling of internal function processing. An attacker with low-privileged database access can send a crafted RESTORE FILELISTONLY command via TDS protocol, causing a stack buffer overflow that crashes sqlservr.exe and can be leveraged for remote code execution as the SQL Server service account. A root cause analysis and DoS PoC reversing svl.dll is publicly available on GitHub.

Tia coverage

First reported2026-08-27

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisa-warns-of-actively-exploited-microsoft-sql-server-rce-vulner

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.