Microsoft SQL Server CVE-2026-77481

Exploitation requires a valid SQL Server account with at least public/low-level privileges (PR:L per CVSS). The SQL Server instance must be network-reachable by the attacker (default TCP 1433 for default instances, or dynamic/named-instance ports). No specific non-default feature, mode, or configuration is stated in the advisory as required - the overflow appears reachable through standard authenticated network sessions. Limiting factors: an attacker without any SQL Server credentials cannot exploit this directly; environments that restrict SQL Server network exposure to specific application-tier IPs and enforce least-privilege login policies significantly reduce the realistic attack surface.

CVSS 8.8 High is well-justified here: AV:N eliminates physical or local-only exposure, AC:L means no special timing or conditions are required, and PR:L is the primary mitigating factor - an attacker must possess at least a low-privileged SQL Server account before exploitation. In enterprise environments where SQL Server logins are distributed to application accounts, developers, or reporting users, this bar is often low. Full C:H/I:H/A:H impact maps to complete database host compromise, including potential data exfiltration, tampering, and service disruption. No KEV listing and no public POC have been identified at time of analysis, placing this in a 'patch promptly but not emergency-drop-everything' tier absent active exploitation signals. SQL Server instances exposed directly to the internet or to broad internal networks with widely shared credentials face the highest realistic risk.

An attacker who has obtained a low-privileged SQL Server login - via credential stuffing, a leaked application connection string, or a compromised application account - connects to the SQL Server over the network and sends a specially crafted T-SQL query or protocol message that overflows a heap buffer in the server process. Successful exploitation yields arbitrary code execution in the context of the SQL Server service account, which in many default deployments runs as NT SERVICE\MSSQLSERVER or a high-privilege domain account, enabling lateral movement or full data exfiltration. No public POC has been identified at time of analysis.