What is the CVSS score of CVE-2026-54116?

CVE-2026-54116 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 1.0%.

Is there a patch available for CVE-2026-54116?

Yes, a patch is available for CVE-2026-54116. Update the affected software to the latest version immediately.

SQL Server 2025 CVE-2026-54116

EUVD-2026-44225 MEDIUM

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-07-14 microsoft

GHSA-g4mf-v8c5-8rjm

Information Disclosure Memory Corruption Microsoft Microsoft Sql Server 2025 For X64 Based Systems Gdr Microsoft Sql Server 2025 Cu 6

6.5

CVSS 3.1 · Vendor: microsoft

Temporal: 5.7

Severity by source

Vendor (microsoft) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

5.7 MEDIUM

cvss

vuln.today AI

6.5 MEDIUM

Network-reachable with low-privilege auth required; type confusion yields read-only data disclosure with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 22:00 vuln.today

CVE Published

Jul 14, 2026 - 17:09 nvd

MEDIUM 6.5

DescriptionCVE.org

Access of resource using incompatible type ('type confusion') in SQL Server allows an authorized attacker to disclose information over a network.

AnalysisAI

Type confusion (CWE-843) in Microsoft SQL Server 2025 enables authenticated, low-privileged network attackers to disclose sensitive server-side information. The CVSS vector (AV:N/PR:L/C:H) confirms that any authorized database user - regardless of their data access permissions - can potentially trigger the flaw remotely with no user interaction required. No public exploit code or CISA KEV listing exists at time of analysis, but the high confidentiality impact and low access complexity make patching a meaningful priority for organizations running SQL Server 2025.

Technical ContextAI

CWE-843 (Type Confusion) describes a condition where code accesses a resource using a type incompatible with the one originally allocated or intended. In a database engine context, this typically manifests when the query processor, memory manager, or a built-in function misinterprets the type of an internal object or buffer, allowing a caller to read memory regions that belong to a different data context. The CPE strings identify two distinct servicing tracks as affected: cpe:2.3:a:microsoft:microsoft_sql_server_2025_(cu_6) (the Cumulative Update channel) and cpe:2.3:a:microsoft:microsoft_sql_server_2025_for_x64-based_systems_(gdr) (the General Distribution Release channel for x64 systems). The tags also reference memory corruption alongside information disclosure, suggesting the type confusion corrupts internal type metadata before exposing it across the network boundary.

RemediationAI

Apply the vendor-released patch available through the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54116. Organizations running the Cumulative Update channel should apply the next CU released after CU 6; those on the GDR channel should apply the corresponding GDR update for x64 systems. The MSRC advisory should be consulted for exact build numbers, as specific fixed versions were not enumerated in the available intelligence. If immediate patching is not feasible, restrict network access to SQL Server 2025 instances by enforcing firewall rules that limit connections to trusted application servers and administrative hosts only, reducing the pool of authenticated users who could trigger the flaw. Additionally, audit and minimize low-privilege account grants on SQL Server 2025 instances to reduce the number of accounts capable of reaching the vulnerable code path. Note that these compensating controls do not eliminate the vulnerability and may impact legitimate reporting or service account workflows.