Microsoft SQL Server CVE-2026-88085

Exploitation requires local access to the SQL Server host and pre-existing high privileges (PR:H) - e.g., a high-privilege SQL Server service or administrative account - meaning this is a privilege-escalation primitive for an attacker who already has a significant foothold, not a remote unauthenticated vector. The high attack complexity (AC:H) further limits exploitation, implying a race condition or precise heap-state requirement that is not reliably repeatable. Affected deployments are specific SQL Server 2017/2019/2022/2025 builds (GDR and CU branches) below the fixed versions listed in EUVD-2026-100617; systems patched to or above those builds (e.g., 16.0.4305.5, 15.0.4500.2, 14.0.3560.2, 17.0.5015.4) are not exposed.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, base 6.4 MEDIUM) describes a local-only attack requiring high existing privileges and a high-complexity trigger, which already caps real-world risk despite the 'total' technical impact. All exploitation signals point the same direction: SSVC records Exploitation=none and Automatable=no, there is no CISA KEV listing, and no public POC is indicated - consistent with the AC:H rating that makes reliable heap-overflow exploitation non-trivial. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified; treat its absence as a data gap rather than a low score. The combination of local vector, PR:H, and 'none/no/total' SSVC indicates a privilege-escalation primitive useful to an attacker who already has a foothold with elevated SQL Server rights, rather than a remotely wormable threat. Net: patch on a normal prioritized cycle (elevated among internal/database-admin threat models), not as a drop-everything remote RCE.

An attacker who already holds high-privilege access on a database host (e.g., a compromised service account or a malicious database administrator) crafts input that triggers a heap-based buffer overflow in SQL Server, corrupting heap memory to run code or gain higher privileges on the local system. Because the CVSS vector is AV:L/PR:H/AC:H, this requires local access, existing high privileges, and a hard-to-win race or precise memory condition. No public exploit code is identified at time of analysis, and SSVC marks exploitation as not automatable.