Microsoft SQL Server CVE-2026-67645

Exploitation requires a valid low-privilege SQL Server credential - either a SQL login or a Windows authentication account with at minimum CONNECT permission to a database. The CVSS PR:L metric confirms this requirement. Network access to the SQL Server listener (default TCP 1433) is also required (AV:N). No special SQL Server features, non-default configurations, or elevated database roles are indicated as prerequisites beyond basic authenticated connectivity. What limits exploitation: the attacker must possess or compromise a database account, ruling out fully unauthenticated attack paths. The vulnerability produces information disclosure only (I:N/A:N), not remote code execution. All four SQL Server generations (2017, 2019, 2022, 2025) running unpatched versions on both GDR and CU servicing tracks are in scope.

CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N reflects a realistic, moderate-to-elevated risk for environments with many SQL logins or broad authentication. The C:H rating signals potential exposure of sensitive in-memory data (query results, server memory regions, credentials buffered in query processing), which is significant in database contexts. Exploitation complexity is low once a valid credential is obtained - a common attacker prerequisite via phishing or credential stuffing. No POC is publicly available and CISA KEV does not list this, suggesting no active mass exploitation at time of analysis. EPSS data is absent from input; risk should be assessed as elevated for multi-tenant or internet-facing SQL Server instances. The four-version-family scope (2017-2025) means organizations running any SQL Server generation are likely affected. The 'Buffer Overflow' tag in the source metadata is a mislabel - the root cause is an out-of-bounds read (CWE-125), a distinct class that typically yields information disclosure rather than arbitrary code execution, consistent with the I:N/A:N CVSS metrics.

An attacker who has obtained a low-privilege SQL login - for example via credential stuffing against a service account or phishing a developer with SQL access - connects to the SQL Server instance over TCP/1433 and submits a crafted query or protocol message that triggers the out-of-bounds read. The server returns memory contents outside the intended buffer, potentially disclosing query result data, internal state, or other in-process memory regions. No public exploit code has been identified, but the low attack complexity (AC:L) means a working exploit requires minimal development effort once the triggering input is identified.