The vulnerability is an integer underflow that can be triggered by an authorized local user and allows the disclosure of sensitive data from Microsoft SQL Server. The weakness is categorized as CWE-191 and results in accidental exposure of information that should be protected, rather than facilitating code execution or other destructive actions.

Microsoft SQL Server 2017 – cumulative update 31 and GDR releases, Microsoft SQL Server 2019 – cumulative update 32 and GDR releases, Microsoft SQL Server 2022 – cumulative update 26 and GDR releases, and Microsoft SQL Server 2025 – cumulative update 8 and GDR releases for x64-based systems.

The CVSS score of 5.5 indicates a moderate severity scenario focused on information disclosure. EPSS data is not provided, and the issue is not listed in the CISA KEV catalog, suggesting low public exploitation risk. The flaw can only be exploited by a user who already has local administrative or authorized access to the SQL Server instance, so it does not enable remote or privilege-escalating attacks.