The flaw is an out‑of‑bounds read (CWE‑125) in the SQL Server query processor. When an attacker with valid database credentials sends a specially crafted request, the server reads beyond the bounds of a buffer and returns inadvertent data. This leakage is sent over the network, exposing locally stored or temporary data to the attacker. The vulnerability does not allow code execution, denial of service, or privilege escalation; it only permits data exposure.

Affected build releases are Microsoft SQL Server 2017 (both the General Distribution Release and the x64 CU31 build), 2019 (General Distribution Release and x64 CU32), 2022 (General Distribution Release and x64 CU27), and 2025 (General Distribution Release and x64 CU9).

The CVSS score of 4.9 shows a moderate impact score, while an EPSS score of less than 1% indicates a very low probability of real‑world exploitation. The vulnerability is not listed in the CISA KEV catalog. Because it requires an authorized attacker, exploitation would normally occur from an internal or compromised network. An adversary with valid SQL credentials could trigger the read over a network connection, causing data to leave the system. The absence of a public exploit makes large‑scale attacks unlikely, but continuous monitoring remains prudent.