EUVD-2026-73380
GHSA-p386-p34m-xfc6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable via TCP, low privilege login required (PR:L), no user interaction; full triad impact from privilege escalation to sysadmin.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Heap-based buffer overflow in Microsoft SQL Server enables an authenticated, low-privileged network attacker to escalate privileges to full control of the database instance. Affected versions span SQL Server 2017 through the newly released SQL Server 2025 across both Cumulative Update (CU) and General Distribution Release (GDR) servicing tracks. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, authenticated SQL Server login at minimum low privilege level (CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-supported by the description: network-reachable, low complexity, requires only a valid SQL Server login (PR:L), and produces full triad impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the appropriate Microsoft-released cumulative update or GDR patch for each installed SQL Server version: SQL Server 2025 CU8 users should upgrade to 17.0.4085.5 or later; SQL Server 2025 GDR users to 17.0.1135.8 or later; SQL Server 2022 CU users to 16.0.4275.2 or later; SQL Server 2022 GDR users to 16.0.1200.5 or later; SQL Server 2019 CU users to 15.0.4490.9 or later; SQL Server 2019 GDR users to 15.0.2190.7 or later; SQL Server 2017 CU users to 14.0.3550.4 or later; SQL Server 2017 GDR users to 14.0.2130.4 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all SQL Server 2017-2025 instances in your environment (both CU and GDR servicing tracks) and classify by business criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today