Microsoft SQL Server EUVD-2026-73189

Exploitation requires a valid, high-privilege SQL Server account - described by Microsoft as an 'authorized attacker', consistent with the CVSS:3.1 PR:H metric. This means the attacker must already hold significant database access (e.g., sysadmin server role, or equivalent). Network access to SQL Server (default TCP 1433) is required, per AV:N. No special non-default configuration is indicated beyond the attacker possessing a privileged credential. The PR:H gate is the primary limiting factor: exploitation is not possible by unauthenticated external actors, anonymous guests, or low-privilege database users - only by those with DBA-level or server-role access.

The provided CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H, score 4.9) presents a notable tension with the advisory description. The description states the flaw 'allows an authorized attacker to execute code over a network', which would conventionally imply C:H/I:H impact; however, the vendor has scored confidentiality and integrity impact as N, reflecting only a confirmed availability (crash) outcome. This is a pattern Microsoft employs when code execution is theoretically possible via heap corruption but not yet demonstrated in a reliable, exploitable form - the CVSS reflects what has been validated rather than what is theoretically achievable. Real-world risk is meaningfully constrained by the PR:H requirement: exploitation demands an authenticated SQL Server session with significant privilege (e.g., a server-role member or DBA-level account), substantially narrowing the attacker pool to insiders, compromised service accounts, or post-breach lateral movement scenarios. No public exploit code exists and the vulnerability is not in CISA KEV, further depressing immediate operational risk. Despite CVSS 4.9, the combination of PR:H constraint and broad version coverage (four major release trains) makes patching advisable, particularly for SQL Server instances accessible from untrusted network segments or shared hosting environments.

An insider attacker or a threat actor who has already compromised a high-privilege SQL Server service account authenticates to SQL Server over the network and sends a specially crafted query or protocol message that triggers the heap buffer overflow in the SQL Server process. In the minimum-impact path this crashes the SQL Server process (DoS); in a more advanced exploitation scenario, the attacker manipulates heap layout to overwrite a code pointer and redirect execution, potentially gaining code execution under the SQL Server service account context.