Out-of-bounds read in Microsoft SQL Server permits an attacker with appropriate privileges to read sensitive data. The flaw is a classic bounds‑checking failure, classified as CWE‑125. The disclosure can reveal any information accessible to the attacker, compromising confidentiality while not directly affecting integrity or availability.

Affected versions are Microsoft SQL Server 2017 (GDR and CU31 for x64), 2019 (GDR and CU32 for x64), 2022 (GDR and CU27 for x64), and 2025 (CU8, CU9 for x64, and GDR for x64).

The CVSS score of 7.7 indicates high risk to confidentiality. The EPSS score of less than 1% suggests that exploitation is currently rare. The vulnerability is not in the CISA KEV catalogue. Based on the description, the attacker must have authorized access to the server and network connectivity to trigger the read.