The vulnerability is a heap‑based buffer overflow that allows an authorized attacker to inject and execute arbitrary code over a network on a SQL Server instance. This can lead to full compromise of the affected machine, with disclosure of confidential data, alteration of database contents, and potential service disruption. The weakness is classified as CWE‑122, indicating an unbounded write to heap memory.

Microsoft reports that the flaw affects multiple versions of SQL Server including 2017 (GDR and CU31), 2019 (GDR and CU32), 2022 (GDR and CU27), and 2025 (GDR and CU9). All impacted builds are x64‑based and were released through official Microsoft update channels.

The CVSS score of 8.5 places the vulnerability in the high severity range, but the EPSS score of less than 1% suggests a low probability of active exploitation at this time, and the flaw is not listed in the CISA KEV catalog. Nonetheless, remote code execution remains a critical threat because the attacker must have valid credentials or authorized network connectivity to the SQL Server, after which malicious code can be executed with the permissions of the SQL Server service account. Security teams should therefore treat the flaw with high priority.