This vulnerability is a heap‑based buffer overflow that allows an authorized attacker who can connect over the network to execute arbitrary code on the affected SQL Server instance, potentially compromising the confidentiality, integrity, and availability of the database system.

Affected versions include Microsoft SQL Server 2017 Global Distribution Release and Cumulative Update 31, Microsoft SQL Server 2019 Global Distribution Release and Cumulative Update 32, Microsoft SQL Server 2022 Global Distribution Release and Cumulative Update 27, and Microsoft SQL Server 2025 Cumulative Update 9 (as well as their respective GDR releases), all running on x64‑based platforms.

The CVSS score of 8.5 classifies this flaw as high severity, while the EPSS score of less than 1 percent indicates a low probability of exploitation in the wild; it is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must be authenticated and able to send crafted queries to the server over the network, and the vulnerability could be triggered from within a trusted network or through exposed remote services. Despite the low exploitation likelihood, the ability to take full control of the database server justifies prompt remediation.