CVE-2016-7254

SQL RDBMS Engine Elevation of Privilege Vulnerability

CVE-2016-7254 is fixed in 8 products on 1 platform, first by KB3194725, released May 27, 2020. It is not reported as exploited. Patch Radar priority: High.

High
CVSS
n/a
Important
Exploitation
None reported
N/A
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.1190
96th percentile

<p>An elevation of privilege vulnerability exists in Microsoft SQL Server when it improperly handles pointer casting. An attacker could exploit the vulnerability if the attacker's credentials allow access to an affected SQL server database.</p> <p>An attacker who successfully exploited this vulnerability could gain elevated privileges that could be used to view, change, or delete data; or create new accounts.</p> <p>The security update addresses the vulnerability by correcting how SQL Server handles pointer casting.</p>

Where it's fixed

ProductFixed inFixReleased
Microsoft
Microsoft SQL Server 2012 for 32-bit Systems Service Pack 2 (CU) KB3194725 May 27, 2020
Microsoft SQL Server 2012 for 32-bit Systems Service Pack 2 (GDR) KB3194719 May 27, 2020
Microsoft SQL Server 2012 for 32-bit Systems Service Pack 3 (GDR) KB3194721 May 27, 2020
Microsoft SQL Server 2012 for 32-bit Systems Service Pack 3 (CU) KB3194724 May 27, 2020
Microsoft SQL Server 2012 for x64-based Systems Service Pack 2 (CU) KB3194725 May 27, 2020
Microsoft SQL Server 2012 for x64-based Systems Service Pack 2 (GDR) KB3194719 May 27, 2020
Microsoft SQL Server 2012 for x64-based Systems Service Pack 3 (CU) KB3194724 May 27, 2020
Microsoft SQL Server 2012 for x64-based Systems Service Pack 3 (GDR) KB3194721 May 27, 2020