Microsoft SQL Server EUVD-2026-100711

Exploitation requires an already-authorized, high-privilege SQL Server session (PR:H) with network reachability to the database instance (AV:N), and the high attack complexity (AC:H) means the attacker must additionally satisfy non-trivial conditions such as precise heap state manipulation or winning a timing/memory race to reliably trigger the CWE-122 heap overflow. The practical limiting factors are: the need for elevated database credentials (not an anonymous or low-privilege user), the high-complexity exploitation barrier, and applicability only to the enumerated unpatched SQL Server 2022 (GDR <16.0.1210.3 / CU <16.0.4305.5) and SQL Server 2025 (GDR <17.0.1145.4 / CU <17.0.5015.4) builds; patched builds and instances not exposed to untrusted authenticated users are not exploitable.

This is a moderate-severity (CVSS 6.6) heap-based buffer overflow (CWE-122) in Microsoft SQL Server. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N materially constrains real-world risk: although the attack is network-reachable (AV:N), it requires high privileges (PR:H - an already-authorized/high-privilege database user) AND high attack complexity (AC:H), meaning the attacker must win a race or satisfy specific conditions beyond simple request delivery. Impact is severe once triggered (C:H/I:H/A:H, scope unchanged), consistent with arbitrary code execution. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no signal of active or likely-imminent exploitation - exploitation status is 'no public exploit identified at time of analysis.' The combination of high privilege requirement plus high complexity makes this a lower practical priority than its code-execution impact suggests: an attacker already holding elevated SQL Server credentials is a precondition, which narrows the realistic threat to insider misuse or post-compromise privilege/impact escalation rather than opportunistic mass exploitation. Priority is elevated for internet-exposed or multi-tenant SQL Server instances but should rank below unauthenticated or low-complexity flaws.

An attacker who already holds high-privilege SQL Server credentials (e.g., a compromised service account or malicious authenticated user) sends specially crafted input over the network that triggers a heap-based buffer overflow in SQL Server, corrupting heap memory to achieve arbitrary code execution in the SQL Server process context. The high attack complexity (AC:H) implies the attacker must satisfy additional conditions such as winning a memory-state race or precise heap grooming. No public exploit code was identified at the time of analysis.