EUVD-2026-44031
GHSA-hx3c-jrf3-3m7r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description's 'authorized attacker' implies a valid login, so PR:L rather than PR:N; network vector, low complexity, and total impact keep C/I/A High.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft SQL Server 2025 (GDR builds 17.0.1050.2 to 17.0.1125.2 and CU 6 line 17.0.4060.2) arises from unsafe deserialization of untrusted data (CWE-502), letting an authorized attacker run arbitrary code over the network with total impact to confidentiality, integrity, and availability. Microsoft, the reporting party, rates it CVSS 9.8, though the description's 'authorized attacker' wording conflicts with the vector's PR:N and should be verified. There is no public exploit identified at time of analysis, EPSS is a moderate 1.29% (67th percentile), and CISA SSVC records exploitation status as none.
Technical ContextAI
The flaw is a classic insecure deserialization (CWE-502) in Microsoft SQL Server 2025, Microsoft's flagship relational database engine. Deserialization vulnerabilities occur when the engine reconstructs .NET/serialized objects from attacker-influenced byte streams without validating type or content, allowing crafted gadget chains to trigger code execution during object reconstruction. The affected CPEs, cpe:2.3:a:microsoft:microsoft_sql_server_2025_(cu_6) and cpe:2.3:a:microsoft:microsoft_sql_server_2025_for_x64-based_systems_(gdr), scope this to the SQL Server 2025 release train on x64 platforms, delivered through both the Cumulative Update (CU) and General Distribution Release (GDR) servicing branches.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54117, upgrading the GDR branch to build 17.0.1125.2 or later (or the corresponding fixed CU build; confirm the exact CU target on MSRC, as the EUVD CU range is malformed). Because the input provides no exact fixed CU version and the MSRC page distinguishes GDR vs CU update paths, select the update matching your installed servicing branch to avoid regressing patch level. Until patched, reduce exposure by restricting network reachability of the SQL Server listener (default TCP 1433) to trusted application hosts via firewall/NSG rules and enforcing least-privilege database logins, which limits who could reach or abuse the deserialization path; note these controls do not remove the flaw and may disrupt legitimate clients if scoped too tightly.
Privilege elevation in Microsoft SQL Server (2016 SP3 through 2025) allows an authenticated attacker to inject crafted S
Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) lets an authenticated attacker with low-privilege
SQL injection in Microsoft SQL Server (versions 2016 through 2025) enables an authenticated attacker to escalate privile
Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) arises from unsafe deserialization of untrusted da
Privilege escalation via external file path control in Microsoft SQL Server affects versions 2016 through 2025, exploita
SQL injection in Microsoft SQL Server 2016-2025 allows authenticated high-privilege attackers to elevate privileges loca
SQL injection in Microsoft SQL Server 2016-2025 allows authenticated high-privilege attackers to elevate privileges loca
Type confusion (CWE-843) in Microsoft SQL Server 2025 enables authenticated, low-privileged network attackers to disclos
Buffer over-read in Microsoft SQL Server 2025 exposes server memory contents to low-privileged authenticated attackers o
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today