An out‑of‑bounds read flaw in Microsoft SQL Server allows an attacker with authorized access to execute code on the server. The vulnerability is classified as CWE‑125, meaning that software reads data beyond the bounds of a buffer. This flaw can be used to divert program execution or to crash the service, ultimately leading to compromise of confidentiality, integrity, or availability of the database and potentially the host system.

Microsoft SQL Server products affected include 2019 (Cumulative Update 32 and GDR), 2022 (Cumulative Update 26 and GDR), and 2025 (Cumulative Update 8 and GDR) for x64‑based systems. These releases are listed under the vendor/product names Microsoft SQL Server 2019, Microsoft SQL Server 2022, and Microsoft SQL Server 2025.

The CVSS base score of 8.5 indicates high severity. While the EPSS score was not reported, the lack of inclusion in the CISA KEV catalog does not reduce the need for remediation. The likely attack vector is an authenticated user who can send specially crafted requests to the SQL Server service over the network. No other prerequisites are stated, so any anchor to the target network with sufficient privileges is sufficient to exploit the flaw.