Microsoft SQL Server EUVD-2026-100604

Exploitation requires the attacker to already possess valid low-privilege authenticated access to the SQL Server instance (PR:L / 'authorized attacker'), and network reachability to the database engine's listener (AV:N). The high attack complexity (AC:H) indicates additional non-default conditions must hold - typically reliable heap layout/grooming or winning a timing-sensitive memory-corruption window - so exploitation is not guaranteed on a single attempt. No end-user interaction is needed (UI:N). Limiting factors defenders can rely on: instances that do not expose network logins to semi-trusted principals, strong segmentation of the database network, and least-privilege login hygiene substantially reduce the realistic attack surface. Affected builds span SQL Server 2017, 2019, 2022, and 2025 (GDR and CU branches) below the fixed builds listed in EUVD-2026-100604; instances already updated to the fixed build for their branch are not exploitable.

This is a credible mid-to-high priority issue but not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.5 HIGH) describes a network-reachable, scope-changing remote code execution with full confidentiality, integrity, and availability impact - but two metrics meaningfully temper the raw severity: AC:H means exploitation requires non-trivial conditions or a difficult-to-win race/memory-grooming step, and PR:L means the attacker must already hold at least low-level authenticated database access. The description's phrase 'authorized attacker' corroborates PR:L - this is NOT an unauthenticated internet-facing bug. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active exploitation or weaponization; exploitation status is best characterized as no public exploit identified at time of analysis. The signals are internally consistent (network vector + authorized attacker + high complexity), with no contradictions to flag. Net: a vendor-confirmed, patch-available RCE in a ubiquitous enterprise database that warrants prompt patching, but the authentication requirement and high attack complexity argue against imminent mass exploitation. Priority should be driven by exposure of SQL Server instances to semi-trusted or compromisable low-privilege accounts.

An attacker who has obtained low-privileged credentials to a SQL Server instance (for example a compromised application service account or a limited database login) sends specially crafted input over the network that triggers a heap-based buffer overflow in the server process. By carefully grooming the heap and winning the conditions implied by the high attack complexity, the attacker corrupts memory to execute arbitrary code in the SQL Server service context, with the changed scope allowing impact beyond the database engine's own security boundary. No public proof-of-concept exploit was identified in the provided data.