A heap-based buffer overflow was identified in Microsoft SQL Server that permits an authenticated attacker with sufficient privileges to execute arbitrary code on the host. The flaw arises when internal memory management fails to prevent an out‑of‑bounds write, effectively hijacking the process execution flow. Because the attacker must already be authorized to run the SQL Server service, the vulnerability is limited to local code execution rather than remote exploitation.

Microsoft SQL Server 2017 GDR and the 64‑bit CU31 release, SQL Server 2019 GDR and the 64‑bit CU32 release, SQL Server 2022 GDR and the 64‑bit CU27 release, SQL Server 2025 CU8 and the 64‑bit CU9 release, as well as the corresponding GDR editions. All 64‑bit builds of these releases are impacted.

The vulnerability carries a CVSS score of 6.7, indicating moderate risk. An EPSS score of less than 1% and absence from CISA’s KEV catalog suggest a very low likelihood of public exploitation. Nevertheless, because the flaw requires authorized credentials, an internal attacker or one who has compromised a privileged account can gain full control of the affected host. The risk is highest when SQL Server runs under high‑privilege accounts or when internal trust boundaries are weak—any single compromised credential could result in system compromise.