EUVD-2026-73186
GHSA-c5hp-67h3-xjp7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Authenticated low-privilege network trigger with no confidentiality or integrity impact; DoS-only outcome consistent with CWE-125 in a database process.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
5DescriptionCVE.org
Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a network.
AnalysisAI
Out-of-bounds read in Microsoft SQL Server 2017 through 2025 enables an authenticated low-privileged attacker to crash the database engine remotely, causing a denial of service. The flaw (CWE-125) is reachable over the network with no user interaction required, making it suitable for disrupting database availability from any network-connected authenticated session. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid SQL Server authentication credential with at minimum a low-privilege login (PR:L per CVSS); no elevated database role or administrative access is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) correctly captures a medium-severity availability-only risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft-released patches for the applicable SQL Server version and servicing track: upgrade SQL Server 2017 GDR to 14.0.2130.4 or later, SQL Server 2017 CU 31 to 14.0.3550.4 or later, SQL Server 2019 GDR to 15.0.2190.7 or later, SQL Server 2019 CU 32 to 15.0.4490.9 or later, SQL Server 2022 GDR to 16.0.1200.5 or later, SQL Server 2022 CU 26 to 16.0.4275.2 or later, SQL Server 2025 CU8 to 17.0.4085.5 or later, and SQL Server 2025 GDR to 17.0.1135.8 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-125 – Out-of-bounds Read
View allShare
External POC / Exploit Code
Leaving vuln.today