Microsoft SQL Server EUVD-2026-73188

Exploitation requires a valid SQL Server login with at least low-privilege access (PR:L per CVSS vector). No elevated privileges, special roles, or administrative access are needed beyond a basic authenticated session. No user interaction on the server side is required. The attack is executable over any network path that reaches SQL Server's listening port (default TCP 1433), with no unusual configuration required - this affects default SQL Server deployments. Limiting factors: an attacker must first obtain SQL Server credentials (e.g., via credential theft, brute force, or compromised application account). The absence of PR:N means unauthenticated exploitation is not supported by the available data.

The CVSS 6.5 rating with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N reflects a moderate-to-significant risk: the attack is low-complexity and requires only a valid SQL Server login, which is a realistic attacker posture in many environments - even a mid-sized municipal IT team in boleslawiec running SQL Server with numerous application service accounts would have non-trivial exposure. The C:H metric signals that disclosed memory could contain high-value data (authentication material, query results, cross-session data). No EPSS data was provided, and the absence of KEV listing and POC reduces urgency somewhat, but the broad version coverage (2017-2025) and authenticated-but-low-privilege exploitation path make this a meaningful patching priority for any SQL Server deployment. The I:N and A:N ratings confirm this is a pure information-disclosure vulnerability with no write or denial-of-service capability.

An attacker with a valid low-privilege SQL Server login - such as a compromised application service account or a developer account - sends a specially crafted query or command that triggers the out-of-bounds read in the server engine. The server returns memory contents beyond the intended buffer, which the attacker reads to extract sensitive in-memory data such as other users' query results, session tokens, or cached credentials. No public exploit code has been identified at time of analysis.