Microsoft SQL Server EUVD-2026-73187

Exploitation requires a valid SQL Server credential with at minimum low-privilege (public role or equivalent) login rights to the target instance - PR:L in the CVSS vector confirms this. The attack is delivered over the network on the standard TDS listener (default TCP 1433), with no user interaction needed. No additional non-default configuration is required beyond having a reachable SQL Server instance with at least one low-privilege account available to the attacker. Exploitation is limited by the credential requirement: unauthenticated external attackers cannot directly exploit this vulnerability. Environments enforcing strong credential hygiene, least-privilege login grants, and network segmentation of the SQL listener materially reduce realistic risk.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) scoring 6.5 correctly captures the threat model: network-exploitable, low-complexity, but gated behind authenticated (low-privilege) access, with impact limited to confidentiality. The PR:L gate significantly constrains real-world risk - an attacker must first obtain at least a low-privilege SQL Server login, which limits opportunistic mass exploitation. No EPSS score was provided, no CISA KEV listing exists, and no POC is known, all consistent with a moderate-priority finding. The high confidentiality impact (C:H) reflects that out-of-bounds reads can leak arbitrary memory regions including query data, connection strings, or credentials in process memory. The 'Buffer Overflow' tag in the source data is a mislabel - CWE-125 is an out-of-bounds read (info disclosure), not a write-side overflow (code execution); defenders should not escalate to RCE assumptions based on that tag.

An attacker with a valid low-privilege SQL Server login - obtained via credential stuffing, a compromised application service account, or internal threat - sends a crafted SQL or protocol-level request that triggers the out-of-bounds read in the server process. The server returns memory contents beyond the intended buffer, which may include fragments of other users' query results, cached credentials, or internal data structures. Because AC:L and UI:N, no special timing or victim interaction is required once the credential is in hand.