Microsoft SQL Server EUVD-2026-100610

Exploitation requires the victim side to initiate or accept a connection to an attacker-controlled SQL Server endpoint (UI:R), meaning the attacker cannot simply hit an exposed listener unprompted - a user or application must be induced to connect, e.g., via a crafted connection string, a malicious linked server, or social engineering of a DBA/client. High attack complexity (AC:H) further implies the malicious response must satisfy specific, non-deterministic conditions to reliably trigger the stack overflow (CWE-121). No authentication is required of the attacker (PR:N). Limiting factors for defenders: the mandatory user/connection interaction and the elevated complexity significantly constrain opportunistic, automatable mass exploitation; environments that restrict outbound SQL connections and linked-server trust reduce exposure. Affected builds are below the fixed versions listed in EUVD (SQL Server 2022 and 2025 GDR/CU trains).

This is a moderate-priority issue rather than a drop-everything emergency, despite the 'remote code execution' framing. The CVSS 3.1 base score is 7.5 (High) with vector AV:N/AC:H/PR:N/UI:R: network-reachable and requiring no privileges (PR:N, unauthenticated), but gated by high attack complexity (AC:H) and mandatory user interaction (UI:R), which materially lowers real-world exploitability. There is an apparent tension worth flagging: the description says an 'unauthorized attacker' can 'execute code over a network,' which sounds like a classic server-side pre-auth RCE, yet the vector's UI:R indicates a victim must perform an action - strongly suggesting a client-side/triggered pattern (e.g., luring a SQL client or linked-server connection to an attacker-controlled malicious SQL Server), not spraying exploits at exposed port 1433. Verify the exact trigger direction with Microsoft's MSRC advisory. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or available exploit code at this time; the only confirmed positive signal is that Microsoft (the reporter/vendor) has shipped a patch. SSVC framing: exploitation = none observed, automatable = likely 'no' given AC:H + UI:R, technical impact = total (C:H/I:H/A:H). Net: patch on a normal prioritized cycle; it is not a high-urgency, widely-automatable threat on current signals.

An attacker stands up a malicious or compromised SQL Server endpoint and, through social engineering or a manipulated connection string/linked server, induces a victim SQL client or server to connect to it (satisfying the UI:R requirement). The malicious server returns a crafted response that overflows a stack buffer in the connection/parsing path, achieving arbitrary code execution in the context of the connecting process. No public exploit code was identified in the provided data, and the high attack complexity (AC:H) implies non-trivial, possibly timing- or layout-dependent conditions.