Microsoft SQL Server CVE-2026-67641

Exploitation requires a valid SQL Server login with at minimum low-privilege access (PR:L per CVSS); anonymous or unauthenticated access is insufficient. The SQL Server instance must be network-reachable from the attacker's position - the CVSS AV:N vector confirms the attack is delivered over the network, not requiring local system access. No special non-default configuration, specific SQL Server features, or elevated roles are implied beyond basic authenticated connectivity. What limits exploitation: the attacker must possess or obtain valid SQL Server credentials; environments using strong credential hygiene, dedicated service accounts with no shared logins, and network segmentation significantly restrict the practical attacker pool. No user interaction or victim action is required beyond the instance being online and reachable.

The CVSS 6.5 score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is well-calibrated for this vulnerability class. The PR:L requirement is the primary limiting factor: an attacker must possess a valid SQL Server login, which constrains exploitation to insider threats, compromised credentials, or environments with broadly shared database accounts. Attack complexity is low once credentials are obtained, and no user interaction is required, meaning exploitation could be scripted or automated against reachable instances. The impact is strictly availability - no confidentiality or integrity risk exists per the CVSS vector. No public exploit code has been identified, and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation. EPSS data was not provided; given the authenticated requirement and availability-only impact, real-world prioritization should focus on internet-exposed SQL Server instances with shared or weakly controlled login accounts, where a disruptive DoS could affect business-critical workloads. Internal, tightly access-controlled deployments face lower practical risk.

An insider or an attacker who has obtained any valid SQL Server login (even a low-privilege read-only account) connects to a vulnerable SQL Server 2022 or 2025 instance over the network and submits a specially crafted query or protocol message designed to trigger the integer wraparound in the server's processing layer. The resulting crash brings down the SQL Server service, severing connections for all users and applications depending on the database until the service is restarted. No public exploit code was identified at time of analysis, but the low attack complexity (AC:L) suggests the trigger could be discovered or re-engineered relatively quickly once a researcher has database access.