The vulnerability in Microsoft SQL Server arises from insecure deserialization of untrusted data, permitting an attacker to execute arbitrary code over the network. The flaw is identified as CWE‑502. When an attacker crafts maliciously serialized data and sends it to the vulnerable SQL Server instance, the server deserializes the data without proper validation, resulting in remote code execution.

Affecting 64‑bit editions of Microsoft SQL Server 2019 (Cumulative Update 32 and GDR), 2022 (Cumulative Update 26, GDR, and x64 Cumulative Update 25), and 2025 (Cumulative Updates 6 and 8, and x64 GDR).

The CVSS score of 8.1 indicates high severity, yet the EPSS score is not available, limiting exact exploitation probability assessment. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this through a network‑based attack by sending specially crafted serialized payloads to an exposed SQL Server endpoint, assuming they can reach the instance over the network. No additional prerequisites are stated, so any open instance that accepts external serialized input is vulnerable.