Microsoft SQL Server EUVD-2026-100609

Exploitation requires the attacker to already hold a valid, low-privileged authenticated context on the target SQL Server instance (PR:L) and local access to the system or an established database session (AV:L) - there is no remote unauthenticated path. The attacker must supply crafted input that reaches the vulnerable heap-allocation code path (CWE-122) and reliably groom the heap, which the high attack complexity (AC:H) indicates depends on specific memory conditions or timing, limiting reliability. Limiting factors: no network-only exploitation, a pre-existing authorized account is mandatory, and successful corruption is non-trivial; environments without untrusted low-privilege principals (e.g., single-tenant instances with only trusted admins) face materially lower practical risk. Affected deployments are specific SQL Server 2019, 2022, and 2025 builds below the patched GDR/CU versions listed in EUVD-2026-100609.

This is a genuine but moderate-priority vulnerability, not a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) scores 7.0 (High) and is internally consistent with the description: local attack vector matches 'elevate privileges locally,' and PR:L matches 'authorized attacker.' The key dampening signals are AV:L (no remote reach - the attacker must already have local access/a database session) and AC:H (high attack complexity, implying the heap overflow requires specific conditions or a race/memory-layout that is not trivially reliable). No EPSS score, CISA KEV listing, SSVC decision, or public POC was provided in the input; per precision rules this is treated as 'no public exploit identified at time of analysis,' which aligns with a newly disclosed, vendor-reported (secure@microsoft.com) bug. The main risk is privilege escalation by an already-authenticated low-privilege SQL Server principal to higher (likely service/SYSTEM or elevated DB) privileges with full C/I/A impact. No signals are directly conflicting; the primary missing data is EPSS and any exploitation telemetry, so widespread automated exploitation cannot be assessed. Prioritize patching on internet-exposed or multi-tenant SQL Server instances where untrusted low-privilege accounts exist.

A low-privileged but authenticated SQL Server principal (e.g., a constrained application login or a user on a shared/multi-tenant database) submits specially crafted input that triggers a heap-based buffer overflow in a vulnerable SQL Server component. By grooming the heap under the required conditions, the attacker corrupts memory to execute code or gain elevated privileges on the host. No public exploit code was identified at the time of analysis, and the high attack complexity (AC:H) means exploitation is non-trivial and may require multiple attempts.