Microsoft SQL Server EUVD-2026-100614

Exploitation requires the attacker to be on an adjacent network (same subnet/broadcast domain or logically adjacent segment, per AV:A) with network reachability to the SQL Server listener; it cannot be performed from an arbitrary internet host. No authentication is required (PR:N) and no user interaction is needed (UI:N). The key LIMITING factor is High attack complexity (AC:H): successful exploitation depends on conditions the attacker does not control, such as specific memory layout, timing, or server state, so the leak is not reliably reproducible on demand. The vulnerability discloses memory contents only (C:H, I:N, A:N) and does not permit modification or denial of service. The specific SQL Server feature, protocol component, or request type that triggers the out-of-bounds read is not detailed in the MSRC description provided.

This is a moderate-severity information-disclosure flaw (CWE-125 out-of-bounds read) carrying a vendor CVSS 3.1 base score of 5.3 with vector AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. The signals are internally consistent and point toward low real-world urgency: the attack vector is Adjacent (AV:A), meaning the attacker must be on the same logical/physical network segment rather than exploiting across the open internet, and attack complexity is High (AC:H), indicating success depends on conditions outside the attacker's direct control. CISA's SSVC decision framework reinforces this - Exploitation is rated 'none', Automatable is 'no', and Technical Impact is only 'partial' - which argues against prioritizing emergency remediation. There is no CISA KEV listing and no public exploit identified at time of analysis, so there is no public exploit identified at time of analysis. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be weighed; absence of EPSS is a data gap, not evidence of low risk. The impact is confidentiality-only (C:H, I:N, A:N): a successful attacker reads memory they should not, with no integrity or availability consequence. Net assessment: a genuine but non-urgent patch-in-normal-cycle issue, not a drop-everything priority - the combination of adjacent-only vector, high complexity, 'none' exploitation status, and confidentiality-only impact all align downward.

An attacker already positioned on the same adjacent network segment as a vulnerable SQL Server instance sends specially crafted input that triggers an out-of-bounds read in the server's memory handling, causing the server to return adjacent memory contents in its response. Because attack complexity is High, the attacker must satisfy specific timing or state conditions to leak meaningful data, and repeated attempts may be needed to recover useful information. No public exploit code has been identified at time of analysis.