Microsoft SQL Server CVE-2026-85876

Exploitation requires the attacker to already have local access to the SQL Server host and to be an authorized (authenticated) principal with at least low privileges (PR:L) - it is not remotely reachable (AV:L) and not usable by an anonymous/unauthenticated actor. The use-after-free (CWE-416) further demands winning a memory-reuse/timing condition, reflected in AC:H, so reliable exploitation is non-trivial and may require repeated attempts. The affected scope is SQL Server 2019, 2022, and 2025 instances on builds below the fixed GDR/CU versions listed in the EUVD data; patched builds remove the condition. The need for prior local authenticated access and the high attack complexity are the primary limiting factors reducing real-world exploitability.

This is a moderate-priority local privilege escalation rather than an urgent remote threat. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) signals an attacker who already has local access and some privilege (PR:L) must win a race or satisfy specific timing/heap conditions (AC:H) to trigger the CWE-416 use-after-free; success yields full confidentiality, integrity, and availability impact within the unchanged scope of the SQL Server process. There is no CISA KEV listing and no public exploit identified, so this is not confirmed to be under active exploitation, and no EPSS score was supplied in the input to gauge exploitation probability - treat exploitation likelihood as undetermined rather than low. No SSVC decision data was provided. The high access complexity (AC:H) and the requirement for existing authenticated access meaningfully lower real-world risk versus the raw 7.0 score; this is a defense-in-depth patch for environments where untrusted or low-privilege database users exist, not a drop-everything emergency. Note a minor signal conflict: the input Tags include 'Denial Of Service', but the description and CVSS describe privilege elevation with full A:H impact - memory-corruption DoS is plausible as a secondary effect, but the authoritative impact per Microsoft/NVD is local elevation of privilege; verify intended impact with the MSRC advisory.

A low-privileged but authenticated local user (for example, a limited database account holder or a user with a foothold on the database host) crafts input or a sequence of operations that triggers the use-after-free in SQL Server, then manipulates the freed-then-reused memory to execute code in the SQL Server process context and elevate privileges on the host. Because access complexity is high, the attacker likely must repeatedly attempt the operation to win a timing/heap race. No public proof-of-concept exploit has been identified at the time of analysis.