The vulnerability is a classic out‑of‑bounds read that allows an authorized attacker to read sensitive data across the network. This flaw is classified as CWE‑125 and results in the unauthorized disclosure of information that should remain confidential, potentially exposing database contents, credentials, or other private data to the attacker.

Affected products are Microsoft SQL Server 2017 (GDR) and the CU31 build for x64 systems, Microsoft SQL Server 2019 (GDR) and the CU32 build for x64 systems, Microsoft SQL Server 2022 (GDR) and the CU27 build for x64 systems, and Microsoft SQL Server 2025 (GDR) and the CU9 build for x64 systems. Only the specified GDR and CU releases are vulnerable; earlier or newer releases are not listed as affected.

The CVSS score of 7.7 places the flaw in the high‑severity range, but the EPSS score of <1% indicates that exploitation attempts are unlikely at present. The flaw’s attack vector is inferred to be network‑based, requiring an authenticated user with sufficient privileges to trigger the out‑of‑bounds read. Because the vulnerability has not been listed in the CISA KEV catalog, there are no known widespread exploitations, yet the potential confidentiality impact warrants prompt remediation.