An uninitialized resource in Microsoft SQL Server enables an attacker with sufficient authorization to read sensitive data over the network, exposing information that should remain confidential. The flaw is cataloged as CWE-908, which signifies that the system proceeds with data handling before proper initialization could be guaranteed. As a result, confidential data stored in the database could be partially or fully exposed to the attacker, potentially leading to privacy violations and allowing further exploitation based on retrieved information.

Affected installations include Microsoft SQL Server 2017 updated to cumulative update 31 or in the GDR branch, SQL Server 2019 updated to CU 32 or GDR, SQL Server 2022 updated to CU 26 or GDR, and SQL Server 2025 updated to CU 8 or the x64-based GDR. These versions are available only on 64‑bit systems.

The CVSS score of 6.5 reflects a moderate severity; the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to be authenticated or have privileged access to the SQL Server instance. After that, the uninitialized resource can be leveraged to transmit secret information back across the network. Because the issue is tied to a specific resource handling bug, it does not appear to allow arbitrary code execution but does compromise confidentiality for connected users.