Microsoft SQL Server CVE-2026-73029

Exploitation requires a valid SQL Server account with at minimum low-privilege (PR:L) network access to the target SQL Server instance on TCP port 1433 (or the configured listener port). No special non-default configuration is implied by available data - any SQL Server 2019, 2022, or 2025 instance in the affected version ranges that accepts authenticated network connections is potentially in scope. Limiting factors: (1) valid SQL credentials are mandatory; (2) SSVC 'Automatable: no' indicates exploitation is not reliably scriptable without additional knowledge of the triggering condition; (3) impact is confidentiality-only with no integrity or availability consequence, limiting attacker utility to data-theft scenarios. Deployments where SQL Server is accessible only from trusted application servers with dedicated service accounts present substantially reduced real-world risk.

CVSS 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N scores high confidentiality impact reachable over the network with only low-privilege credentials, which is noteworthy for an information-disclosure class. However, SSVC qualifications materially reduce urgency: exploitation is rated 'none' (no current exploitation observed), automatable is 'no' (suggesting non-trivial trigger conditions not fully reflected in the AC:L rating, perhaps requiring specific query patterns or feature invocation), and technical impact is 'partial.' No EPSS data was provided, no KEV listing exists, and no public POC has been identified. The disconnect between AC:L in CVSS and 'Automatable: no' in SSVC is notable - the SSVC signal likely reflects that reliably extracting useful data from the over-read requires attacker-controlled conditions beyond simply sending a network packet. Real-world priority is moderate: patch within normal patch-cycle windows for internet-facing or multi-tenant SQL Server instances, and de-prioritize for tightly access-controlled internal deployments.

An attacker with a valid low-privilege SQL Server login connects over the network and submits a specially crafted query or T-SQL command that triggers the buffer over-read in the server's parsing or execution engine. The server reads beyond the intended buffer and returns the excess memory contents within the response, potentially exposing data from other in-flight queries, connection metadata, or internal engine state. No public POC exists, and reliable exploitation likely requires knowledge of the specific triggering query pattern.