An out‑of‑bounds read exists in Microsoft SQL Server that permits an unauthenticated attacker to read data from memory locations outside the intended buffer. This flaw can expose sensitive data on the server, resulting in unauthorized disclosure of information such as credentials, database contents, or other confidential material. The weakness is identified as CWE‑125.

Microsoft SQL Server products affected by this vulnerability include versions 2019 (GDR), 2019 for x64‑based systems (CU32), 2022 (GDR), 2022 for x64‑based systems (CU27), 2025 (CU8), 2025 for x64‑based systems (CU9), and 2025 for x64‑based systems (GDR). Administrators should verify whether any of these products, particularly the specified cumulative update releases, are installed in their environments.

The CVSS base score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests that this vulnerability is unlikely to be actively exploited in the wild. It is not currently listed in the CISA KEV catalog. The attack vector is inferred to be over an adjacent network, meaning a threat actor with network proximity to the SQL Server could exploit the flaw to read memory and exfiltrate information. Adequate network segmentation and patching can mitigate the risk.