The vulnerability is a heap-based buffer overflow that allows an authorized attacker to execute arbitrary code over a network. This flaw stems from improper bounds checking during memory operations (CWE‑122), leading to a moderate impact with a CVSS score of 6.6. The attacker would learn how to gain code execution only if they have authorized database access, which could compromise the confidentiality, integrity, and availability of the affected instance.

Microsoft SQL Server 2022 (GDR) and CU27, Microsoft SQL Server 2025 CU8 and CU9, and Microsoft SQL Server 2025 (GDR) for x64-based systems are impacted. These versions run on x64-based systems and must be identified with the provided CPEs.

The CVSS score of 6.6 indicates moderate severity, while the EPSS score of less than 1% implies a low likelihood of exploitation at this time. The flaw is not listed in CISA's KEV catalog. The likely attack vector requires network connectivity to the SQL Server instance and an authorized account, potentially limiting exploitation to internal adversaries who can supply crafted packets to trigger the overflow.