The vulnerability is a heap‑based buffer overflow in Microsoft SQL Server that can be triggered by an authorized user. Exploiting the overflow allows the attacker to gain elevated privileges on the machine. The flaw is a classic buffer overrun identified as CWE‑122, potentially letting a user bypass normal access controls and run arbitrary code with higher rights.

Microsoft SQL Server 2019 (GDR) and the 2019 x64 CU32 update, Microsoft SQL Server 2022 (GDR) and the 2022 x64 CU27 update, Microsoft SQL Server 2025 (CU8) and the 2025 x64 CU9 update, as well as the 2025 x64 GDR release. These versions run on x64‑based systems and are affected by the heap overflow described.

The CVSS score of 7.0 indicates a medium severity. The EPSS figure of less than 1% suggests a low probability of abuse at present, and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector requires local, authenticated access, meaning that users with sufficient database permissions could exploit the flaw to elevate to higher privileges. While the risk is moderate, the impact of gaining elevated rights could be significant if the attacker acquires system‑level access.