Microsoft SQL Server EUVD-2026-73182

The attacker must hold any valid SQL Server credential with at least the lowest authentication tier (PR:L) - this can be an application service account, a public-role member, or any minimally provisioned SQL login. No specific non-default feature, configuration setting, or deployment mode is named in the description as a prerequisite; the vulnerability appears reachable via standard SQL Server network connectivity. Exploitation is strictly bounded by the authentication requirement: fully anonymous network exploitation is not supported based on the CVSS PR:L metric. The vulnerability is confined to SQL Server 2025 (version 17.x) on x64-based systems under either the GDR or CU8 servicing tracks; earlier SQL Server versions are not listed as affected.

The CVSS 8.8 score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H represents a genuine high-priority enterprise risk. The network attack vector with low complexity and no required user interaction means any holder of a valid SQL Server credential - including application service accounts, vendor logins, or minimally provisioned guest users - can attempt exploitation remotely without victim interaction. Full C/I/A impact signals code execution on the SQL Server host, which typically serves as a high-value data repository in enterprise environments. PR:L is the sole limiting factor constraining the attack surface; it excludes fully anonymous exploitation but does not require elevated database roles. No EPSS score was provided in the input data, and no CISA KEV listing is present, meaning no confirmed active exploitation has been observed. No public proof-of-concept is known. Despite the absence of active exploitation signals, the low attack complexity, broad enterprise footprint of SQL Server, and full-impact CVSS metrics make this a realistic near-term exploitation target once technical details circulate; patching should be treated as urgent for internet-facing or broadly accessible SQL Server instances.

An attacker holding a compromised application service account or minimally provisioned SQL login connects over the network to a vulnerable SQL Server 2025 instance and submits a specially crafted SQL query or TDS protocol message designed to overflow a heap buffer in a network-reachable SQL Server component. The heap corruption overwrites control structures, allowing the attacker to redirect execution and run arbitrary code under the SQL Server process account - typically a high-privilege Windows service account with access to all databases on the instance. No public proof-of-concept is currently known, but the low attack complexity (AC:L) makes independent exploit development feasible for skilled researchers once the affected component is identified.