Microsoft SQL Server CVE-2026-77488

Exploitation requires an authenticated session against the SQL Server instance by an account holding at minimum a low-privileged SQL Server login or Windows account with local access - consistent with the CVSS PR:L and AV:L metrics and the description's phrase 'authorized attacker...locally.' No user interaction by a higher-privileged user is needed. Exploitation is not automatable from the network without prior credential compromise or local account access. Conditions that limit exploitation: remote-only internet-facing deployments without direct local or intranet access to the SQL Server instance are not directly reachable; the attack requires an existing authenticated session rather than a pre-auth path; and the vulnerability is limited to information disclosure only, with no write or availability primitive exposed.

The overall real-world risk is moderate-to-low despite the C:H confidentiality impact. The local attack vector (AV:L) is the primary risk limiter: an attacker must already have authenticated, local or network-adjacent access to a SQL Server instance, which is not achievable from an unauthenticated internet-facing position. SSVC confirms Automatable: no, meaning mass scanning or automated exploitation is not feasible, and Technical Impact is assessed as only partial. EPSS data is not present in the provided intelligence, but the combination of no KEV listing, no public PoC, and a local-only vector suggests very limited exploitation pressure. The integrity and availability metrics are both N, so no data modification or service disruption is possible via this path alone. Even a mid-sized municipal IT team in rybnik operating a standard SQL Server estate should treat this as a normal patch-cycle item rather than an emergency, given the absence of exploitation signals and the non-remotely-automatable attack profile.

A low-privileged database user or OS account with local access to the SQL Server host crafts a query or procedure call that triggers an integer underflow in an internal buffer boundary calculation, causing the engine to read beyond the intended memory region and return data that should be inaccessible to that principal. No public proof-of-concept has been identified at time of analysis, so precise triggering conditions are not independently confirmed.