The vulnerability allows an authorized attacker to control the file name or path used by SQL Server, enabling arbitrary code execution over the network. The flaw is identified as CWE‑73. Because the attacker can specify arbitrary file paths, the server may load or execute unintended code, leading to compromise of confidentiality, integrity, and availability of the database system.

Affected are Microsoft SQL Server 2016 Service Pack 3 (including the GDR and Azure Connect Feature Pack), 2017 CU 31 and its GDR, 2019 CU 32 and its GDR, 2022 GDR and the x64 CU 24, as well as 2025 CU 4 and its GDR. All listed releases run on 64‑bit operating systems.

The CVSS score of 8.8 classifies the issue as high severity. EPSS is not available, making current exploitation likelihood uncertain, and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector involves an authorized user whose connection to SQL Server can dictate a file name or path; exploitation would require that the attacker has sufficient permissions to instruct the server to process the supplied path, after which arbitrary code can be executed.