Microsoft SQL Server CVE-2026-67638

Exploitation requires a valid SQL Server login with at least low-privilege access to the target SQL Server 2025 instance, as indicated by the PR:L metric in the CVSS vector; any standard database login (application account, read-only reporting user, etc.) satisfies this threshold. The attacker must be able to reach the SQL Server over a network connection (AV:N), typically on TCP port 1433 or the configured listener port. No user interaction is required (UI:N) once the attacker has network access and credentials. The vulnerability is constrained to Microsoft SQL Server 2025 in the identified version ranges (GDR <17.0.1135.8; CU8 <17.0.4085.5); earlier SQL Server major versions are not indicated as affected. Unauthenticated exploitation is not supported by the CVSS vector.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-calibrated: the flaw is network-reachable at low attack complexity, requiring only a valid database login, with full confidentiality, integrity, and availability impact on the SQL Server process. The PR:L authentication requirement is the primary mitigating factor - unauthenticated exploitation is not supported by the CVSS vector. EPSS data is absent from the provided intelligence and cannot be independently assessed. No CISA KEV listing has been confirmed and no public exploit code has been identified, so exploitation status is inferred as not publicly exploited at time of analysis. Despite the absence of known active exploitation, organizations should treat this as high-priority given that SQL Server instances are frequently accessible to many low-privilege internal accounts such as application service accounts and reporting users, and the low attack complexity rating implies exploitation is reliably repeatable once the triggering input pattern is known.

An attacker who possesses or has compromised a low-privilege SQL Server 2025 login connects to the database instance over the network and sends a specially crafted TDS protocol request that triggers the heap buffer overflow in the affected code path. Successful exploitation corrupts heap memory and redirects execution flow, achieving arbitrary code execution in the context of the SQL Server service process. No public exploit code has been identified, but the low attack complexity rating (AC:L) implies the overflow is reliably and repeatably triggerable once the correct malformed input pattern is identified.