Microsoft SQL Server EUVD-2026-73184

Exploitation requires a valid SQL Server credential with at minimum low-privilege query execution rights ('authorized attacker' per the description, reflected as PR:L in the CVSS vector). The vulnerability is reachable over the network without additional user interaction. No special non-default SQL Server configuration appears to be required based on the description. Exploitation is limited by the authentication gate: unauthenticated network actors and users without SQL Server login access cannot trigger the flaw. Organizations using SQL Server with guest accounts enabled or broadly provisioned service accounts face elevated risk.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately captures the threat model: network-reachable, low-complexity exploitation, but gated behind valid SQL Server credentials (PR:L), with impact limited to confidentiality only. The C:H metric reflects that OOB reads in a database engine can surface high-value data - query results, schema metadata, or process memory - rather than just arbitrary padding bytes. No public exploit code is known, and this CVE does not appear in the CISA KEV catalog, indicating no confirmed in-the-wild exploitation at time of analysis. EPSS data is not provided in the input, so exploitation probability cannot be quantified. The authentication prerequisite substantially narrows the attacker population compared to unauthenticated SQL Server flaws; organizations should nevertheless treat patching as a standard-cycle priority, since SQL Server instances routinely hold regulated or high-value data. The 'Buffer Overflow' tag in the input metadata is a mislabel - CWE-125 is a read primitive, not a write/overflow primitive, and carries no code-execution primitive absent an additional vulnerability.

An attacker with a valid SQL Server login - such as a compromised application service account or a low-privilege developer credential - submits a crafted query or protocol message that triggers an out-of-bounds read in the SQL Server engine. The server's response includes memory contents from outside the intended buffer, potentially leaking in-memory query data, internal structures, or adjacent session state. No public proof-of-concept code has been identified at time of analysis.