Microsoft SQL Server CVE-2026-67625

Exploitation requires the attacker to already possess a low-privilege authenticated SQL Server login (CVSS PR:L) with network access to the SQL Server instance (AV:N); it is NOT remotely exploitable by an unauthenticated attacker. The high attack complexity (AC:H) further limits exploitation: a successful heap-based buffer overflow (CWE-122) generally demands reliable control of heap memory layout, making consistent exploitation non-trivial. No user interaction is required (UI:N). The description does not name a specific non-default feature or configuration setting, so the flaw appears reachable through normal authenticated query/request processing against affected SQL Server 2017-2025 builds below the patched versions listed in EUVD. Primary limiting factors for defenders: valid credentials are mandatory and exploit reliability is reduced by AC:H.

This is a credible, above-average priority for environments running Microsoft SQL Server, but not a drop-everything emergency based on current signals. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, score 8.5) indicates network-reachable code execution with full confidentiality, integrity, and availability impact and a scope change - but two metrics temper the real-world risk: AC:H means exploitation is not trivial (heap overflows typically require memory grooming/specific conditions), and PR:L means the attacker must already hold low-privilege authenticated database access, not anonymous network access. No EPSS score, KEV listing, or SSVC decision data was provided in the input, and no public exploit was identified at time of analysis - so there is no evidence of active exploitation or weaponization. The combination of required authentication plus high attack complexity suggests this is more likely to matter as a privilege-escalation/post-compromise step (an attacker with a low-priv SQL login escalating to code execution on the host) than as a mass-exploited internet worm. Missing data to note explicitly: EPSS probability is absent (cannot gauge likelihood of widespread exploitation), and KEV status is absent (treat as not-yet-known-exploited rather than confirmed-not-exploited).

An attacker who has already obtained a low-privilege authenticated SQL Server login (e.g., via leaked application credentials or SQL injection yielding a database session) sends a specially crafted query or request that triggers a heap-based buffer overflow in the SQL Server process. Because attack complexity is high, the attacker must reliably control heap layout, but on success they execute arbitrary code in the context of the SQL Server service. No public exploit code was identified at time of analysis.