Microsoft SQL Server EUVD-2026-100613

Exploitation requires the attacker to possess valid low-privileged SQL Server credentials (PR:L) and network reachability to the SQL Server instance (AV:N) - it is NOT remote-unauthenticated. The description explicitly specifies an 'authorized attacker', confirming authentication is a prerequisite. The high attack complexity (AC:H) indicates additional limiting conditions, such as specific server state, timing, or non-trivial crafted requests, must be met to trigger the unbounded resource allocation. Affected builds are SQL Server 2019 (CU32 below 15.0.4500.2, GDR below 15.0.2200.2) and SQL Server 2025 (CU8); impact is confined to service availability with no confidentiality or integrity effect.

This is a moderate-severity, authenticated denial-of-service issue (CVSS 5.3) in Microsoft SQL Server stemming from unbounded resource allocation (CWE-770). The CVSS vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H shows the signals align consistently toward LOW real-world priority: the attack is network-reachable (AV:N) but requires high attack complexity (AC:H) and valid low-level credentials (PR:L), with impact limited to availability only (C:N/I:N/A:H). CISA's SSVC decision framework reinforces this - Exploitation: none, Automatable: no, Technical Impact: partial - indicating no observed exploitation and that the flaw cannot be reliably automated for mass exploitation. There is no CISA KEV listing and no public exploit code identified, and no EPSS score was supplied in the input (missing data - exploitation probability cannot be quantified). The combination of required authentication, high complexity, no scope change, and availability-only impact means this is a high-footprint-product issue but not an urgent, widely-weaponizable one; it should be patched on a normal enterprise cycle rather than as an emergency. No CVSS/description conflicts were observed - the description ('authorized attacker to deny service over a network') matches PR:L and AV:N precisely.

An attacker who already holds valid low-privileged SQL Server credentials sends specially crafted or repeated requests over the network that cause the server to allocate resources without limits, exhausting memory or other resources and denying service to legitimate users. The high attack complexity (AC:H) implies the attacker must meet specific timing or state conditions, or craft a non-trivial request, to trigger the flaw. No public exploit code has been identified at time of analysis.