The vulnerability is caused by an externally controlled format string that can be supplied when an attacker has authorized access to a Microsoft SQL Server instance. When the server processes this format string, an internal error occurs and the service terminates, resulting in a denial of service. This weakness falls under CWE‑134, which indicates an externally controlled format string that can trigger unintended behavior.

Affected releases are Microsoft SQL Server 2017 (including the General Distribution Release and the CU31 cumulative update for x64-based systems), Microsoft SQL Server 2019 (including the General Distribution Release and the CU32 cumulative update for x64-based systems), Microsoft SQL Server 2022 (including the General Distribution Release and the CU27 cumulative update for x64-based systems), and Microsoft SQL Server 2025 (including the General Distribution Release and the CU9 cumulative update for x64-based systems).

The CVSS base score of 4.9 places the flaw in the medium severity range. The EPSS score is below 1 %, suggesting the probability of exploitation in the wild is low. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. Attackers must possess authorized credentials or compromise the target system to inject the malicious format string; the attack vector is over the network, and the resulting impact is a temporary loss of availability for the SQL Server instance, which can disrupt dependent applications and services.