What is the CVSS score of CVE-2025-49718?

CVE-2025-49718 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 1.9%.

Which versions of Sql Server 2019 are affected by CVE-2025-49718?

CVE-2025-49718 is a high-severity information disclosure vulnerability in SQL Server that permits unauthenticated remote attackers to access sensitive data through uninitialized resource handling.. A patch is available.

How to fix or mitigate CVE-2025-49718?

Within 24 hours: inventory all SQL Server deployments and their network exposure status; identify instances accessible remotely. Within 7 days: apply vendor-released patch to all affected SQL Server systems and validate remediation in non-production environments first. Within 30 days: complete patching across all production systems and conduct access control audit to restrict SQL Server network exposure where possible.

Sql Server 2019 CVE-2025-49718

EUVD-2025-20550 HIGH

Use of Uninitialized Resource (CWE-908)

2025-07-08 secure@microsoft.com

Information Disclosure Sql Server 2019 Sql Server 2022

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:29 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

16.0.1140.6,16.0.4200.1,15.0.2135.5

EUVD ID Assigned

Mar 16, 2026 - 04:21 euvd

EUVD-2025-20550

Analysis Generated

Mar 16, 2026 - 04:21 vuln.today

CVE Published

Jul 08, 2025 - 17:15 nvd

HIGH 7.5

DescriptionCVE.org

Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network.

Analysis

Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network.

Technical ContextAI

This vulnerability is classified as Use of Uninitialized Resource (CWE-908).

RemediationAI

Monitor vendor advisories for patches. Apply mitigations such as network segmentation, access restrictions, and monitoring.

More in Sql Server 2019

View all

CVE-2026-21262 HIGH This Week POC

8.8 Mar 10

SQL Server 2016-2025 contains an improper access control flaw that allows authenticated network attackers to escalate pr

CVE-2025-49759 HIGH This Week

8.8 Aug 12

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized

CVE-2025-49758 HIGH This Week

8.8 Aug 12

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized

CVE-2025-53727 HIGH This Week

8.8 Aug 12

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized

CVE-2026-26115 HIGH This Week

8.8 Mar 10

Privilege escalation in SQL Server 2016-2025 stems from insufficient input validation, enabling authenticated network at

CVE-2026-26116 HIGH This Week

8.8 Mar 10

Authenticated users can exploit SQL injection vulnerabilities in SQL Server 2016-2025 to escalate privileges and gain un

CVE-2025-49717 HIGH This Week

8.5 Jul 08

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

CVE-2025-49719 HIGH This Week

7.5 Jul 08

Improper input validation in SQL Server allows an unauthorized attacker to disclose information over a network.

CVE-2025-59499 HIGH This Month

8.8 Nov 11

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized

CVE-2025-55227 HIGH This Month

8.8 Sep 09

Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized a

CVE-2025-47997 MEDIUM This Month

6.5 Sep 09

Concurrent execution using shared resource with improper synchronization ('race condition') in SQL Server allows an auth

CVE-2025-24999 HIGH This Month

8.8 Aug 12

Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network. Rated high sev

Same weakness CWE-908 – Use of Uninitialized Resource

View all

CVE-2011-1255 CRITICAL POC

9.3

CVE-2024-12085 HIGH POC

7.5

CVE-2026-58051 HIGH POC

8.3

CVE-2025-1942 CRITICAL

9.8

CVE-2026-42969 MEDIUM

5.5

CVE-2026-53225 CRITICAL

9.1

CVE-2026-2806 CRITICAL

9.1

CVE-2026-4716 CRITICAL

9.1

Same technique Information Disclosure

View all

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2014-6324 HIGH POC

8.8

CVE-2017-0213 HIGH POC

7.3

CVE-2016-7255 HIGH POC

7.8

CVE-2010-0232 HIGH POC

7.8

CVE-2025-30066 HIGH POC

8.6

CVE-2025-54236 CRITICAL POC

9.1

CVE-2025-49718 vulnerability details – vuln.today

Back

Sql Server 2019 CVE-2025-49718

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

More in Sql Server 2019

Same weakness CWE-908 – Use of Uninitialized Resource

Same technique Information Disclosure

Share

External POC / Exploit Code