Microsoft SQL Server CVE-2026-94512

Exploitation requires the attacker to already hold a valid SQL Server login with at least low privileges (PR:L) and network reachability to the SQL Server instance's listening port; no user interaction is needed. The limiting factors are therefore authentication (any valid database credential, not necessarily sysadmin) and network exposure of the SQL Server endpoint - instances firewalled to trusted app tiers and using strong, non-shared credentials substantially reduce reachable attack surface. Affected builds are specific: SQL Server 2017 (GDR <14.0.2140.2, CU31 <14.0.3560.2), 2019 (GDR <15.0.2200.2, CU32 <15.0.4500.2), 2022 (GDR <16.0.1210.3, CU27 <16.0.4305.5), and 2025 (GDR <17.0.1145.4, CU9 <17.0.5015.4); instances already patched to these build numbers or above are not exposed.

This is a credible, actionable priority rather than an inflated high-CVSS issue, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) indicates a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with full high impact to confidentiality, integrity, and availability (C:H/I:H/A:H, scope unchanged) - consistent with an authenticated user achieving code execution within the SQL Server process context. The description's phrase 'authorized attacker' aligns cleanly with PR:L, so the signals are internally consistent and there is no attack-vector/privilege conflict to flag. However, key exploitation-likelihood signals are MISSING from the input: no EPSS probability was provided, the flaw is NOT listed in CISA KEV, and no public POC is referenced - so there is no evidence of active exploitation or weaponization at this time. The realistic risk driver is that SQL Server instances frequently grant low-privilege application or service logins, meaning the PR:L barrier is low in many environments; an attacker who already holds any valid database login (e.g., via a compromised app credential) could escalate to code execution on the database host. Because exploitation-probability data is absent, prioritize based on exposure and privilege hygiene rather than on confirmed in-the-wild activity.

An attacker possessing a low-privileged but valid SQL Server login (for example, a reused or leaked application service credential) connects over the network and submits crafted input that triggers the heap-based buffer overflow (CWE-122) in the server's parsing logic. Successful corruption of heap memory lets the attacker execute arbitrary code in the context of the SQL Server service, potentially compromising the database and underlying host. No user interaction is required, and no public exploit code is currently identified.