CVE-2016-7250
SQL RDBMS Engine Elevation of Privilege Vulnerability
CVE-2016-7250 is fixed in 10 products on 1 platform, first by KB3194716, released November 8, 2016. It is not reported as exploited. Patch Radar priority: High.
High
CVSS
n/a
Important
Exploitation
None reported
Exploitation Less Likely
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.1199
96th percentile
<p>An elevation of privilege vulnerability exists in Microsoft SQL Server when it improperly handles pointer casting. An attacker could exploit the vulnerability if the attacker's credentials allow access to an affected SQL server database.</p> <p>An attacker who successfully exploited this vulnerability could gain elevated privileges that could be used to view, change, or delete data; or create new accounts.</p> <p>The security update addresses the vulnerability by correcting how SQL Server handles pointer casting.</p>
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Microsoft | |||
| Microsoft SQL Server 2014 Service Pack 1 for 32-bit Systems (CU) | KB3194722 | May 27, 2020 | |
| Microsoft SQL Server 2014 Service Pack 1 for 32-bit Systems (GDR) | KB3194720 | May 27, 2020 | |
| Microsoft SQL Server 2014 Service Pack 1 for x64-based Systems (CU) | KB3194722 | May 27, 2020 | |
| Microsoft SQL Server 2014 Service Pack 1 for x64-based Systems (GDR) | KB3194720 | May 27, 2020 | |
| Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems (CU) | KB3194718 | May 27, 2020 | |
| Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems (GDR) | KB3194714 | May 27, 2020 | |
| Microsoft SQL Server 2014 Service Pack 2 for x64-based Systems (CU) | KB3194718 | May 27, 2020 | |
| Microsoft SQL Server 2014 Service Pack 2 for x64-based Systems (GDR) | KB3194714 | May 27, 2020 | |
| Microsoft SQL Server 2016 for x64-based Systems (CU) | KB3194717 | May 27, 2020 | |
| Microsoft SQL Server 2016 for x64-based Systems (GDR) | KB3194716 | Nov 8, 2016 | |