Microsoft SQL Server CVE-2026-67390

Exploitation requires a valid SQL Server login with at least low-privilege database access (consistent with PR:L in the CVSS vector); unauthenticated network access is insufficient. The attacker must have network connectivity to the SQL Server listener (default TCP 1433). No non-default SQL Server feature or configuration setting is identified as a prerequisite - the vulnerable code path is reachable through standard authenticated database operations. Exploitation is bounded by the authentication barrier: the attacker must possess valid credentials, whether obtained through credential theft, phishing, insider access, or a compromised application service account. The scope is limited to confidentiality (I:N/A:N), so integrity and availability are not at risk.

The CVSS 6.5 (Medium) score is well-calibrated for this class of vulnerability: network-reachable, low complexity, low-privilege, and confidentiality-only impact. The PR:L requirement is the key limiting factor - the attacker must already hold a valid SQL Server login, reducing the exploitable population to insider threats, compromised application accounts, or phishing victims. No EPSS data or CISA KEV listing is present in the input, and no public proof-of-concept has been identified, indicating no confirmed active exploitation at time of analysis. Even a mid-sized municipal IT team in koszalin managing SQL Server instances exposed to internal networks with broadly scoped database accounts should treat this as a priority patch, since C:H means the memory leak could expose credentials, query results, or session data from other users. The mislabeled 'Buffer Overflow' tag could cause triage inflation - defenders should note this is a read-side CWE-126, ruling out code execution.

An attacker with a valid low-privilege SQL Server database account connects over the network and submits a crafted query or command that triggers the buffer over-read in the server process. The server returns data read beyond the intended buffer boundary, which may include memory from adjacent allocations such as other users' query results, internal tokens, or server-side credentials. No public proof-of-concept has been identified, so exploitation currently requires independent vulnerability research or access to undisclosed tooling.