The vulnerability is a heap-based buffer overflow (CWE-122) in Microsoft SQL Server that permits an authorized user to gain higher privileges remotely. An attacker who has legitimate access to the database can exploit the overflow to elevate privileges, potentially allowing them to execute arbitrary commands or gain administrative control of the SQL Server instance. The primary impact is privilege escalation, compromising both confidentiality and integrity of the affected database.

Affected systems include Microsoft SQL Server 2017 GDR and CU31 for x64, Microsoft SQL Server 2019 GDR and CU32 for x64, Microsoft SQL Server 2022 GDR and CU27 for x64, and Microsoft SQL Server 2025 CU8, CU9 for x64 and GDR. Institutions running any of these versions must confirm installation status of the patch.

The issue has a CVSS score of 8.5, indicating high severity. The EPSS score is below 1 %, suggesting a low probability of exploitation at the time of analysis. It is not currently catalogued in CISA’s KEV. Because the description specifies that an authorized attacker can act over the network, the likely attack vector is a network or local connection that the attacker already uses. The exploit requires an attacker to have legitimate credentials, but the overflow enables them to raise their privilege level, which significantly increases the risk of full compromise of the SQL Server environment.