Microsoft SQL Server CVE-2026-67629

Exploitation requires a valid SQL Server login with at minimum low-privilege access (CVSS PR:L). The attack is conducted over the network (AV:N) without requiring additional user interaction (UI:N) or elevated complexity (AC:L). No specific non-default configuration or feature enablement is stated as required. Exploitation is limited by the authentication prerequisite - unauthenticated network attackers cannot exploit this. The scope of readable data is confined to the SQL Server process memory (S:U, no scope change), and there is no integrity or availability impact.

CVSS 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N reflects a realistic threat profile: an authenticated SQL Server user (low privileges sufficient) can exploit this remotely without user interaction, achieving high confidentiality impact. The absence of integrity and availability impact (I:N/A:N) limits this to data leakage rather than service disruption or data tampering. No EPSS data was provided in the input, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. No public proof-of-concept has been referenced. The real-world priority is moderate: SQL Server deployments are pervasive in enterprise environments, and the PR:L requirement means any valid database login - including application service accounts - could be a vector. The high C: impact suggests potential exposure of sensitive in-memory data, possibly including query results from other sessions, authentication material, or configuration secrets, though the exact data class readable is not confirmed in the available sources.

An attacker with a valid low-privilege SQL Server login - such as a compromised application service account or a read-only reporting user - submits a crafted T-SQL query or protocol message designed to trigger the out-of-bounds read condition in the server process. The server reads beyond a buffer boundary and returns the leaked memory contents to the attacker over the existing authenticated network connection. No public exploit code has been identified, but the AC:L rating indicates no special preconditions are needed beyond authentication.