Microsoft SQL Server EUVD-2026-100611

Requires a valid SQL Server authentication context (PR:L) reachable over the network - i.e., the attacker must hold or obtain a low-privileged database login and be able to open a connection to the SQL Server TDS endpoint (default TCP 1433 or a named-instance port). No user interaction and no special non-default configuration is indicated (UI:N, AC:L), so any instance accepting logins from untrusted or lower-trust principals is exposed. Limiting factors: exploitation is gated by the authentication requirement (unauthenticated remote attackers cannot trigger it), impact is confined to information disclosure (no write/DoS), and affected instances must be unpatched builds within the listed 2017/2019/2022/2025 GDR and CU ranges.

This is a credible but second-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) describes a network-reachable, low-complexity attack that nonetheless requires valid low privileges (PR:L) and yields confidentiality-only impact - no integrity or availability loss. The scope change (S:C) is what elevates the score, implying disclosed data can extend beyond the directly vulnerable component (e.g., memory contents outside the attacker's own authorization boundary). No EPSS score, CISA KEV listing, or SSVC decision data was supplied; there is no public exploit identified at time of analysis. The signals are therefore internally consistent (an authenticated info-disclosure bug) rather than conflicting, but the absence of EPSS/KEV means real-world exploitation pressure cannot be quantified from this data. Net: a meaningful patch-soon issue for exposed SQL Server instances where untrusted or low-privileged accounts can connect, but not an emergency given the authentication requirement and read-only impact. Note the 'Buffer Overflow' tag is misleading - CWE-125 is an out-of-bounds read, not an overflowing write, so this is a memory-disclosure primitive, not code execution.

A low-privileged but authenticated database user (or an attacker who has obtained any valid SQL Server login, e.g., via a compromised application account) sends a specially crafted query or request that triggers an out-of-bounds read in the server's processing logic, causing adjacent server memory to be returned to the attacker. Over repeated requests this could leak sensitive in-memory data such as other sessions' data or internal structures. No public proof-of-concept is identified at time of analysis, and low attack complexity (AC:L) means no special timing or race conditions are needed once a login is held.