A heap-based buffer overflow in Microsoft SQL Server enables the execution of arbitrary code when the vulnerable server processes data from an authorized user. This flaw is a classic memory corruption bug identified as CWE-122, allowing the attacker to gain control of the server after exploiting the overflow.

Affected vendors and product lines include Microsoft SQL Server 2017 (both the General Distribution Release and the x64-based Revision CU31), Microsoft SQL Server 2019 (both the General Distribution Release and the x64-based Revision CU32), Microsoft SQL Server 2022 (both the General Distribution Release and the x64-based Revision CU27), and Microsoft SQL Server 2025 (both the General Distribution Release and the x64-based Revision CU9). Only the specified cumulative update packages are impacted; earlier releases are not listed as affected by the data.

The vulnerability is rated a CVSS score of 8.8, indicating high severity. However, the EPSS score is below 1 %, which suggests that, at present, the likelihood of widespread exploitation is low and the flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog. The attack requires an attacker to be authenticated to the target system (an authorized user), so lateral movement through network privileges or compromised accounts may be necessary. Based on the description, it is inferred that the flaw does not require any special technical skill to exploit beyond what is normally required to access a networked database service, so it remains a significant risk in environments where SQL Server is exposed to untrusted networks.