A use‑after‑free flaw in Microsoft SQL Server can be triggered by a local attacker who has sufficient permissions to modify database objects. The flaw permits execution of code with higher privileges than the SQL Server service process. Based on the description, it is inferred that the attacker could use the elevated privileges to access additional system resources or perform actions that require higher rights.

Affected vendors and products include Microsoft SQL Server 2019 (including the General Distribution Release and CU32), Microsoft SQL Server 2022 (GDR and CU27), and Microsoft SQL Server 2025 (CU8, CU9, and the GDR). The vulnerability applies to x64‑based systems in the generic 64‑bit editions of each version.

The CVSS score of 7 indicates a medium‑to‑high severity. The EPSS score is reported as <1%, indicating a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, so there is no publicly confirmed exploitation. Attackers would need local authenticated access to the SQL Server instance. The use‑after‑free condition can allow arbitrary code execution with elevated privileges, enabling further compromise potential, although the likelihood of active exploitation remains low.