Technical impact
The vulnerability is an out‑of‑bounds read (CWE‑125) in Microsoft SQL Server that can be triggered by an authorized attacker. The flaw allows the attacker to read memory containing sensitive data and return it across the network, resulting in information disclosure. The attack requires legitimate access to the SQL Server instance but does not require elevated privileges beyond normal authorized use.
Affected Systems
Affected products include Microsoft SQL Server versions 2017, 2019, 2022, and 2025 that use the specified cumulative updates or generic deployment rollouts. Specifically, SQL Server 2017 CU 31 and its GDR, SQL Server 2019 CU 32 and its GDR, SQL Server 2022 CU 26 and its GDR, and SQL Server 2025 CU 8 and its GDR on x64-based systems are impacted.
Risk and Exploitability
The CVSS v3 base score of 6.5 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet. The flaw can be exploited over the network by an attacker who already has authenticated access to the SQL Server. No additional special privileges or conditions are required beyond normal authorized use.
