EUVD-2026-73303
GHSA-6m72-p3fw-wjjv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable SQL listener, low complexity, PR:L for required SQL login, full code execution impact justifies C:H/I:H/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Integer overflow or wraparound in SQL Server allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft SQL Server affects versions 2017 through 2025 via an integer overflow that triggers a heap-based buffer overflow in the database engine. An authenticated low-privileged attacker reachable over the network can exploit this flaw to achieve full system compromise - confidentiality, integrity, and availability all rated High. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Authentication is required: the attacker must hold a valid SQL Server login with at minimum low privileges (PR:L per CVSS), such as a guest account, application service account, or any domain account with a SQL login mapped. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 scores this at 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - a network-reachable, low-complexity, authenticated-but-low-privilege exploit with full CIA impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the fixed build for your installed SQL Server branch: SQL Server 2017 GDR → 14.0.2130.4 or later; SQL Server 2017 CU 31 → 14.0.3550.4 or later; SQL Server 2019 GDR → 15.0.2190.7 or later; SQL Server 2019 CU 32 → 15.0.4490.9 or later; SQL Server 2022 GDR → 16.0.1200.5 or later; SQL Server 2022 CU 26 → 16.0.4275.2 or later; SQL Server 2025 GDR → 17.0.1135.8 or later; SQL Server 2025 CU8 → 17.0.4085.5 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all SQL Server 2017-2025 deployments across your infrastructure and identify systems exposed to authenticated users, including application servers and client connections. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today