Untrusted pointer dereference in SQL Server

# check-CVE-2026-33120.ps1
# Purpose: Determine whether locally installed Microsoft SQL Server instances are vulnerable to CVE-2026-33120
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=all discovered instances patched, 1=one or more vulnerable, 2=unknown / unable to assess

$ErrorActionPreference = 'Stop'

function Compare-Version {
    param(
        [Parameter(Mandatory=$true)][string]$A,
        [Parameter(Mandatory=$true)][string]$B
    )

    $aParts = $A.Split('.') | ForEach-Object { [int]$_ }
    $bParts = $B.Split('.') | ForEach-Object { [int]$_ }
    $max = [Math]::Max($aParts.Count, $bParts.Count)

    for ($i = 0; $i -lt $max; $i++) {
        $av = if ($i -lt $aParts.Count) { $aParts[$i] } else { 0 }
        $bv = if ($i -lt $bParts.Count) { $bParts[$i] } else { 0 }
        if ($av -lt $bv) { return -1 }
        if ($av -gt $bv) { return 1 }
    }
    return 0
}

function Test-InRange {
    param(
        [Parameter(Mandatory=$true)][string]$Version,
        [Parameter(Mandatory=$true)][string]$MinInclusive,
        [Parameter(Mandatory=$true)][string]$MaxExclusive
    )

    return ((Compare-Version -A $Version -B $MinInclusive) -ge 0 -and (Compare-Version -A $Version -B $MaxExclusive) -lt 0)
}

# Vulnerable version ranges from NVD / Microsoft CNA data
$ranges = @(
    @{ Branch='SQL Server 2016 GDR'; Min='13.0.6300.2'; Max='13.0.6485.1' },
    @{ Branch='SQL Server 2016 CU/GDR'; Min='13.0.7000.253'; Max='13.0.7080.1' },
    @{ Branch='SQL Server 2017 GDR'; Min='14.0.1000.169'; Max='14.0.2105.1' },
    @{ Branch='SQL Server 2017 CU/GDR'; Min='14.0.3006.16'; Max='14.0.3525.1' },
    @{ Branch='SQL Server 2019 GDR'; Min='15.0.2000.5'; Max='15.0.2165.1' },
    @{ Branch='SQL Server 2019 CU/GDR'; Min='15.0.4003.23'; Max='15.0.4465.1' },
    @{ Branch='SQL Server 2022 GDR'; Min='16.0.1000.6'; Max='16.0.1175.1' },
    @{ Branch='SQL Server 2022 CU/GDR'; Min='16.0.4003.1'; Max='16.0.4250.1' },
    @{ Branch='SQL Server 2025 GDR'; Min='17.0.1000.7'; Max='17.0.1110.1' },
    @{ Branch='SQL Server 2025 CU/GDR'; Min='17.0.4006.2'; Max='17.0.4030.1' }
)

$instanceRoots = @(
    'HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\Instance Names\SQL',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Microsoft SQL Server\Instance Names\SQL'
)

$instances = @()
foreach ($root in $instanceRoots) {
    if (Test-Path $root) {
        $props = Get-ItemProperty -Path $root
        foreach ($p in $props.PSObject.Properties) {
            if ($p.Name -notmatch '^PS') {
                $instances += [PSCustomObject]@{
                    InstanceName = $p.Name
                    InstanceId   = [string]$p.Value
                    SourcePath   = $root
                }
            }
        }
    }
}

$instances = $instances | Sort-Object InstanceName, InstanceId -Unique

if (-not $instances -or $instances.Count -eq 0) {
    Write-Output 'UNKNOWN - No SQL Server instances discovered in registry.'
    exit 2
}

$foundVuln = $false
$foundUnknown = $false

foreach ($inst in $instances) {
    $setupPaths = @(
        "HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\$($inst.InstanceId)\Setup",
        "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Microsoft SQL Server\$($inst.InstanceId)\Setup"
    )

    $version = $null
    $edition = $null

    foreach ($sp in $setupPaths) {
        if (Test-Path $sp) {
            try {
                $item = Get-ItemProperty -Path $sp
                if ($item.Version) { $version = [string]$item.Version }
                if ($item.Edition) { $edition = [string]$item.Edition }
                if ($version) { break }
            } catch {
                # continue
            }
        }
    }

    if (-not $version) {
        Write-Output ("UNKNOWN - Instance '{0}' ({1}) version could not be determined." -f $inst.InstanceName, $inst.InstanceId)
        $foundUnknown = $true
        continue
    }

    $matchedRange = $null
    foreach ($r in $ranges) {
        if (Test-InRange -Version $version -MinInclusive $r.Min -MaxExclusive $r.Max) {
            $matchedRange = $r
            break
        }
    }

    if ($matchedRange) {
        $foundVuln = $true
        if ($edition) {
            Write-Output ("VULNERABLE - Instance '{0}' version {1} ({2}); matches {3} vulnerable range {4} to < {5}." -f $inst.InstanceName, $version, $edition, $matchedRange.Branch, $matchedRange.Min, $matchedRange.Max)
        } else {
            Write-Output ("VULNERABLE - Instance '{0}' version {1}; matches {2} vulnerable range {3} to < {4}." -f $inst.InstanceName, $version, $matchedRange.Branch, $matchedRange.Min, $matchedRange.Max)
        }
    } else {
        if ($edition) {
            Write-Output ("PATCHED - Instance '{0}' version {1} ({2}); not in published vulnerable ranges for CVE-2026-33120." -f $inst.InstanceName, $version, $edition)
        } else {
            Write-Output ("PATCHED - Instance '{0}' version {1}; not in published vulnerable ranges for CVE-2026-33120." -f $inst.InstanceName, $version)
        }
    }
}

if ($foundVuln) {
    exit 1
} elseif ($foundUnknown) {
    exit 2
} else {
    exit 0
}