Microsoft SQL Server CVE-2026-67633

Exploitation requires a valid SQL Server authentication credential with at minimum a low-privilege login (PR:L per CVSS); no elevated database role or administrative access is needed. The attacker must have network connectivity to the SQL Server instance (TCP 1433 or configured alternate port). No special server configuration, non-default features, or user interaction are required beyond authenticated access. Exploitation is limited by the need to possess or obtain valid credentials; unauthenticated access is not sufficient. Organizations using Windows Authentication with Kerberos and network-level firewall restrictions to trusted subnets substantially reduce exposure.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) correctly captures a medium-severity availability-only risk. The low-privileges requirement (PR:L) means any valid SQL Server login - including application service accounts with minimal grants - can trigger the crash, significantly widening the realistic attacker pool beyond database administrators. The network attack vector with no user interaction makes this automatable once credentials are obtained. EPSS data is not provided; however, the lack of KEV listing and no public exploit lower the urgency relative to the raw CVSS. The primary real-world concern is insider threat or post-credential-compromise scenarios where an attacker with a low-privilege database account wants to disrupt availability. The tags 'Buffer Overflow' and 'Information Disclosure' are both inaccurate for this vulnerability - the actual root cause is an out-of-bounds read (CWE-125) and the only confirmed impact is availability (C:N in CVSS), which may inflate perceived severity if taken at face value. No EPSS score or KEV listing is present in the supplied data.

An attacker who has obtained a low-privilege SQL Server login - through credential stuffing, a compromised application service account, or insider access - connects to the SQL Server instance over the network and sends a crafted query or protocol message that triggers the out-of-bounds read, causing the SQL Server process to crash and denying service to all connected clients. No public exploit has been identified at time of analysis, but the low-complexity, network-reachable nature means that once a triggering input is identified, exploitation is straightforward.