Microsoft SQL Server EUVD-2026-100707

Exploitation requires the attacker to already be an authenticated principal holding HIGH privileges on the target SQL Server instance (CVSS PR:H; the description calls this an 'authorized attacker'), and to reach the server over the network (AV:N) - typically a live TDS/SQL connection. The decisive limiting factor is AC:H: the stack overflow (CWE-121) is not triggered by trivial input but depends on specific conditions such as particular server state, data, or timing, so exploitation is not reliable on the first attempt. Practical risk is therefore concentrated in environments where a high-privilege-but-non-sysadmin boundary is security-relevant (hosted/multi-tenant databases, compromised application service accounts); where every PR:H principal is already a fully trusted administrator, the elevation offers the attacker little. All listed affected builds are pre-patch; applying the GDR/CU updates that reach the fixed build numbers (e.g., 16.0.1210.3, 15.0.4500.2, 14.0.2140.2, 17.0.1145.4) removes the condition.

This is a genuine but conditional risk rather than a drop-everything emergency. The CVSS 3.1 base score of 8.0 (AV:N/AC:H/PR:H/UI:N/S:C) reflects a network-reachable flaw whose impact crosses the component scope (S:C) with high confidentiality, integrity and availability impact - consistent with code execution/privilege elevation out of the SQL Server service. However, two metrics materially temper urgency: AC:H (high attack complexity, implying non-trivial conditions such as winning a race or crafting state-dependent input) and PR:H (the attacker must already hold high privileges on the database). The description's phrase 'authorized attacker' aligns with PR:H, so the signals are internally consistent - this is a privilege-elevation primitive for an already-authenticated high-privilege principal, not an unauthenticated remote takeover. No EPSS score, SSVC decision, KEV listing, or POC is present in the provided data; per input, there is no public exploit identified at time of analysis and the vulnerability is not in CISA KEV. The absence of exploitation-probability signals means prioritization should lean on exposure and patch status: a vendor patch is available, which is the single most actionable fact. Net assessment: moderate-to-high real-world priority for internet- or widely-exposed SQL Server instances and multi-tenant/hosted databases where a high-privilege-but-not-sysadmin boundary matters, but lower urgency in environments where the only principals holding PR:H are already fully trusted administrators.

An attacker who already holds high database privileges (e.g., a compromised application service account or a malicious high-privileged DBA on a shared/hosted SQL Server) sends specially crafted input over the network connection that overflows a stack buffer in the server, corrupting control data to execute code in the SQL Server process context and elevate beyond their assigned boundary. The high attack complexity (AC:H) means the overflow likely depends on specific state or timing, so reliable exploitation requires effort. No public exploit code was identified in the provided data.