The vulnerability is an out‑of‑bounds read that allows an attacker with authorized access to read data at arbitrary memory locations and transmit that data across the network. This results in an information disclosure that may reveal confidential database content. The flaw corresponds to CWE-125 and was assigned a CVSS score of 6.5, indicating a moderate level of severity.

Affected products are Microsoft SQL Server 2025, including the CU8 cumulative update release and the 2025 GDR for x64‑based systems. Only these editions are listed; other SQL Server versions are not mentioned.

The flaw requires an attacker to already have valid credentials or to be able to connect to the SQL Server instance, so the typical attack vector is authenticated network access. Because the EPSS score is unavailable and the vulnerability is not listed in the CISA known‑exploited catalog, the likelihood of real‑world exploitation appears limited, but the moderate CVSS 6.5 score still warrants remediation. Exploit would allow the attacker to read arbitrary memory and exfiltrate information over the network.