Microsoft SQL Server allocates resources without limits or throttling, allowing an authorized attacker to flood the server with resource-intensive operations that exhaust memory or CPU, ultimately causing the database process to become unresponsive. The resulting denial of service disrupts availability for applications that depend on the database, and there is no evidence of direct compromise to confidentiality or integrity; this conclusion is inferred from the description.

The vulnerability affects Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2019 for x64‑based Systems (CU32), and Microsoft SQL Server 2025 (CU8).

The CVSS score of 5.3 rates the vulnerability as moderate, and the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet had widespread or publicly known exploitation. Based on the description, the likely attack vector is a local or network attacker with authorized access who can send specially crafted queries; this inference is drawn because the exploit requires credentialed access to force the server to allocate resources.