Microsoft SQL Server EUVD-2026-100710

Exploitation requires the attacker to already have high privileges (PR:H) and local access (AV:L) on the host running Microsoft SQL Server - i.e., an authenticated, already-privileged database or local account rather than a remote anonymous user. No user interaction is required (UI:N) and attack complexity is low (AC:L) once those prerequisites are met. The limiting factors are substantial: the need for pre-existing elevated privileges and local access means a remote, unauthenticated attacker cannot directly exploit this, which is why CISA SSVC rates it non-automatable. Affected deployments are SQL Server 2017, 2019, 2022, and 2025 builds below the fixed versions listed in EUVD (e.g., 2022 GDR <16.0.1210.3, 2019 GDR <15.0.2200.2); patched builds are not vulnerable.

This is a moderate-priority issue that does not rise to emergency status despite the 'total' technical impact. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N, base 6.7) requires local access and, critically, high privileges (PR:H) on the SQL Server host, which already presupposes a significant level of compromise or legitimate administrative access. CISA SSVC reinforces this: Exploitation is 'none' (no observed or public exploitation), Automatable is 'no' (not amenable to mass/wormable exploitation given the local, high-privilege prerequisite), and Technical Impact is 'total' (consistent with the C:H/I:H/A:H and code execution). There is no KEV listing and no POC reported, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent - a high-impact but hard-to-reach bug - so there is no contradiction to flag. Net assessment: patch within normal cycles; it is a privilege-dependent local code-execution flaw rather than a widely weaponizable remote threat.

An attacker who already holds high-privilege (e.g., db admin / local) access to a host running SQL Server supplies crafted input that triggers a heap-based buffer overflow in the SQL Server process, corrupting heap memory to execute arbitrary code in that process's context. Because the CVSS vector is AV:L/PR:H, this requires local access and existing elevated privileges, making it a privilege-abuse/escalation-style local attack rather than remote exploitation. No public proof-of-concept or active exploitation is reported.