Untrusted data deserialized by Microsoft SQL Server allows an unauthorized attacker to run arbitrary code over the network, constituting a remote code execution flaw rooted in a deserialization weakness (CWE-502). The vulnerability can be triggered by trusted connections that pass malicious payloads to the SQL Server engine, after which the attacked server will execute attacker‑supplied code with the privileges of the SQL Server service. This level of compromise threatens all data managed by the database and undermines its confidentiality, integrity, and availability.

The advisory indicates the flaw affects Microsoft SQL Server 2025 Community Update 6 and 2025 for x64‑based Systems (GDR). The associated CPE entries list x64 editions of SQL Server from 2016 through 2025, suggesting that the identified engine component is common across these releases, but only the 2025 releases are explicitly cited as affected. Systems running these product editions should treat the vulnerability as applicable.

The CVSS score of 9.8 classifies the vulnerability as critical, and the EPSS score of 1 % indicates that while exploitation is not widespread, it remains feasible in the wild. The CVE is not yet listed in the CISA KEV catalog. Exploitation requires network access to the SQL Server service, with an attacker able to send crafted serialized payloads; the impact is limited to the host executing the SQL Server engine. Monitoring for abnormal deserialization traffic, reducing exposure by blocking unnecessary ports, and applying the fix are prudent measures.