Improper neutralization of special elements in SQL Server SQL commands creates a classic SQL injection vulnerability that lets a local, authorized attacker inject and execute malicious queries. The injected code can bypass normal security controls and obtain higher privileges, allowing the attacker to gain administrative rights or access sensitive data. The weakness is a classic example of CWE‑89 SQL injection.

Affected products are Microsoft SQL Server 2016 Service Pack 3 (GDR) and the Azure Connect Feature Pack, SQL Server 2017 (CU 31 and GDR), SQL Server 2019 (CU 32 and GDR), SQL Server 2022 (GDR and CU 24 for x64‑based systems), and SQL Server 2025 (CU 3 and the x64 GDR). All listed releases run on 64‑bit platforms.

The CVSS base score of 6.7 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known exploits. The flaw requires a local, authenticated user with access to SQL Server; there is no mention of remote exploitation. Therefore the risk is moderate but any system with an affected SQL Server should patch promptly to eliminate the local privilege escalation pathway.