A stack-based buffer overflow flaw in Microsoft SQL Server permits an authenticated attacker to gain elevated privileges over the network. The flaw arises from improper handling of memory on the stack and was classified as CWE‑121. If successfully exploited, an attacker could gain higher‑level access to the SQL Server instance, potentially compromising data confidentiality and integrity across the connected applications.

Microsoft SQL Server versions affected include the 2017 General Distribution Release, the 2017 x64-based system cumulative update CU31, the 2019 General Distribution Release, the 2019 x64-based system CU32, the 2022 General Distribution Release, the 2022 x64-based system CU27, the 2025 x64-based system CU9, and the 2025 General Distribution Release. These releases run on Windows servers that host enterprise databases.

The vulnerability carries a CVSS score of 8, indicating high severity. Its EPSS score is less than 1 %, suggesting a low probability of exploitation in the wild. The CVE is not listed in CISA’s KEV catalog. Attackers must be authenticated and act over a network to trigger the overflow, making the attack vector Network with a user credential requirement. Given the high severity and the need for internal access, organizations should assess the risk based on their exposure to the database.