A stack-based buffer overflow flaw in Microsoft SQL Server allows an unauthorized attacker to execute arbitrary code over a network. The vulnerability exposes a single, remote code execution vector that can be leveraged without user interaction.

The flaw affects Microsoft SQL Server 2022 CU 26, GDR, 2022 for x64-based Systems CU 27, SQL Server 2025 CU 8, SQL Server 2025 for x64-based Systems CU 9, and SQL Server 2025 for x64-based Systems GDR. All affected installations share the same underlying code that handles network requests, enabling the overflow to be triggered remotely.

The CVSS score of 7.5 indicates a high level of severity. The EPSS score of less than 1% suggests that, as of now, the probability of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need network access to the SQL Server instance; the flaw is likely exploitable from a remote machine that can connect to the database port.