A heap‑based buffer overflow in Microsoft SQL Server allows an attacker with authorized access to execute arbitrary code over the network. The vulnerability is triggered by malformed input that corrupts memory on the server side, enabling execution under the privileges of the SQL Server instance. No additional consequences such as denial of service or data tampering are described in the official text.

Microsoft SQL Server 2017 (Current Update 31, GDR), Microsoft SQL Server 2019 (Current Update 32, GDR), Microsoft SQL Server 2022 (Current Update 26, GDR), and Microsoft SQL Server 2025 (Current Update 8, GDR) on 64‑bit platforms.

The CVSS score of 8.8 classifies the flaw as high severity. EPSS data is not available, so the frequency of exploitation cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog, and no public exploits have been reported as of the last update. The attack vector is remote over the network to a SQL Server instance that the attacker is authorized to use; the description confirms the overflow can be triggered by crafted requests sent over the network.