EUVD-2026-44224
GHSA-89h6-3v24-5cwv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable SQL Server requires only a valid low-privilege login; buffer over-read is read-only yielding C:H with no integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
AnalysisAI
Buffer over-read in Microsoft SQL Server 2025 exposes server memory contents to low-privileged authenticated attackers over the network, resulting in high confidentiality impact with no integrity or availability consequences. Both the Cumulative Update 6 (CU 6) and General Distribution Release (GDR) servicing tracks on x64-based systems are confirmed affected per vendor CPE data. No public exploit has been identified and CISA has not listed this in KEV; SSVC assessment corroborates no active exploitation at time of analysis, placing this in a measured but real priority category for environments handling sensitive SQL data.
Technical ContextAI
CWE-126 (Buffer Over-read) describes a condition where server-side code reads beyond the intended boundary of an allocated memory buffer, potentially returning adjacent memory contents - which may include query results, authentication material, or other sensitive in-process data - to the requesting client. In this case the flaw resides in Microsoft SQL Server 2025's network-facing data processing layer, reachable via standard SQL Server protocols (e.g., TDS over TCP). CPE strings confirm two distinct affected product tracks: the Cumulative Update branch at CU 6 (cpe:2.3:a:microsoft:microsoft_sql_server_2025_(cu_6)) and the General Distribution Release for x64-based systems (cpe:2.3:a:microsoft:microsoft_sql_server_2025_for_x64-based_systems_(gdr)). The GDR track typically receives only security fixes, confirming Microsoft identified this as a standalone security issue warranting out-of-band servicing.
RemediationAI
Apply the vendor-released security update per Microsoft's MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50468; the input data confirms a patch is available but does not specify the exact fixed build numbers - these must be verified directly from the advisory before deployment. Organizations should update all SQL Server 2025 instances on both the CU and GDR servicing tracks. As a compensating control where immediate patching is operationally infeasible, restrict TCP access to SQL Server port 1433 (and any non-standard SQL ports in use) to only trusted application servers and administrative hosts using host-based or network firewall rules, which reduces the attacker pool to already-authenticated, network-adjacent principals; note this does not eliminate the flaw and may impact legitimate application connectivity requiring testing. Additionally, auditing and tightening SQL login permissions to ensure no accounts carry more than the minimum necessary privileges limits the pool of identities capable of triggering the vulnerability.
Privilege elevation in Microsoft SQL Server (2016 SP3 through 2025) allows an authenticated attacker to inject crafted S
Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) lets an authenticated attacker with low-privilege
SQL injection in Microsoft SQL Server (versions 2016 through 2025) enables an authenticated attacker to escalate privile
Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) arises from unsafe deserialization of untrusted da
Remote code execution in Microsoft SQL Server 2025 (GDR builds 17.0.1050.2 to 17.0.1125.2 and CU 6 line 17.0.4060.2) ari
Privilege escalation via external file path control in Microsoft SQL Server affects versions 2016 through 2025, exploita
SQL injection in Microsoft SQL Server 2016-2025 allows authenticated high-privilege attackers to elevate privileges loca
SQL injection in Microsoft SQL Server 2016-2025 allows authenticated high-privilege attackers to elevate privileges loca
Type confusion (CWE-843) in Microsoft SQL Server 2025 enables authenticated, low-privileged network attackers to disclos
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today