This SQL Server vulnerability results from improper handling of special elements inside SQL commands, effectively enabling a classic SQL injection attack. An attacker who already possesses authorized access to the server can inject malicious code, which is then executed by the database engine. The consequence is a local elevation of privileges, allowing the attacker to gain higher database or operating‑system rights and potentially access confidential data or modify system configuration.

Microsoft SQL Server 2016 Service Pack 3 (GDR) and Azure Connect Feature Pack, Microsoft SQL Server 2017 CU 31 and GDR, Microsoft SQL Server 2019 CU 32 and GDR, Microsoft SQL Server 2022 GDR and x64 CU 24, and Microsoft SQL Server 2025 CU 3 and x64 GDR are affected. The issue spans both on‑premises deployments and Azure‑connected instances.

The CVSS score of 6.7 indicates a moderate severity. Exploitability is limited to users who already hold legitimate server access, as the flaw is local. Because the vulnerability is stored as a SQL injection, an attacker would need to craft a query that the database accepts and then trigger the elevated privileges. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, so it is not currently known to be actively exploited in the wild.