SQL Server deserializes untrusted data, allowing an authorized attacker to execute arbitrary code over the network. This is a high‑severity flaw classified as CWE‑502, which can compromise confidentiality, integrity, and availability of the affected instance when the attacker can authenticate and send crafted payloads.

Microsoft SQL Server 2019 GDR and CU32, 2022 GDR and CU27, and 2025 CU9 and GDR for x64‑based systems are affected.

The CVSS score is 8.8, indicating a high severity. EPSS is <1%, suggesting a low current exploit probability, and the vulnerability is not listed in CISA’s KEV catalog. An attacker must possess legitimate credentials or otherwise authenticate to the server to send malicious serialized data, and can then run arbitrary code, posing a severe risk if internal users or compromised accounts are used.