A heap‑based buffer overflow in Microsoft SQL Server allows an authorized attacker to execute arbitrary code locally. The vulnerability corrupts heap memory and hijacks control flow, as the CVEs CWE-122 and CWE-20 indicate. The impact is the ability to run arbitrary code on the system hosting the SQL Server instance.

The flaw affects Microsoft SQL Server 2017 (GDR and CU31 for x64-based Systems), Microsoft SQL Server 2019 (GDR and CU32 for x64-based Systems), Microsoft SQL Server 2022 (GDR and CU27 for x64-based Systems), and Microsoft SQL Server 2025 (CU8, CU9 and GDR for x64-based Systems). Users running these versions on x64-based systems should confirm their build and install the vendor update.

The CVSS score of 6.7 classifies this as a moderate severity flaw, while the EPSS score of less than 1% indicates a low likelihood of exploitation in the near future. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits. Based on the description, it is inferred that an attacker must have legitimate SQL Server access to trigger the overflow; a local attacker can provide specially crafted input to a vulnerable routine and gain code execution on the server.