Description
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
Published: 2026-09-08
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Patch
AI Analysis

Impact

The vulnerability is an out-of-bounds read in Microsoft SQL Server that enables an authorized attacker to disclose sensitive information over a network. The flaw is a classic buffer overread, classified as CWE-125, and leads primarily to confidentiality compromise without impacting integrity or availability.

Affected Systems

Affected products include Microsoft SQL Server 2017 (CU 31 and GDR), SQL Server 2019 (CU 32 and GDR), SQL Server 2022 (CU 26 and GDR), and SQL Server 2025 (CU 8 and GDR). These versions are deployed on x64‑based systems.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity. EPSS is currently unavailable and the vulnerability is not listed in CISA’s KEV catalog. The attack vector requires an attacker who is already authorized to access the SQL Server instance, making the exploitation scenario more limited in scope but still significant for internal or privileged users.

Generated by OpenCVE AI on September 8, 2026 at 19:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Microsoft security update for the affected SQL Server versions to eliminate the out‑of‑bounds read.
  • Restrict network access to the SQL Server instances by allowing only trusted hosts or subnets and applying strict firewall rules.
  • Enforce the principle of least privilege for database accounts, removing any unnecessary permissions to reduce the potential impact if an authorized attacker gains access.

Generated by OpenCVE AI on September 8, 2026 at 19:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 08 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 08 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
Title Microsoft SQL Server Information Disclosure Vulnerability
First Time appeared Microsoft
Microsoft sql Server 2017
Microsoft sql Server 2019
Microsoft sql Server 2022
Microsoft sql Server 2025
Weaknesses CWE-125
CPEs cpe:2.3:a:microsoft:sql_server_2017:*:-:*:*:*:*:x64:*
cpe:2.3:a:microsoft:sql_server_2019:*:*:*:*:*:*:x64:*
cpe:2.3:a:microsoft:sql_server_2022:*:*:*:*:*:*:x64:*
cpe:2.3:a:microsoft:sql_server_2025:*:*:*:*:*:*:x64:*
Vendors & Products Microsoft
Microsoft sql Server 2017
Microsoft sql Server 2019
Microsoft sql Server 2022
Microsoft sql Server 2025
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Sql Server 2017 Sql Server 2019 Sql Server 2022 Sql Server 2025
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-09-25T21:30:37.439Z

Reserved: 2026-07-29T22:49:19.795Z

Link: CVE-2026-67630

cve-icon Vulnrichment

Updated: 2026-09-08T20:30:20.773Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-08T18:18:23.347

Modified: 2026-09-08T21:18:26.130

Link: CVE-2026-67630

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-27T21:45:14Z

Weaknesses