Microsoft SQL Server EUVD-2026-73190

Exploitation requires a valid low-privileged local account on the SQL Server host machine or an authenticated SQL Server login, as established by CVSS PR:L and AV:L. The attack is local - the attacker must be able to execute SQL queries or interact directly with the SQL Server instance on the host system; network-based remote exploitation without prior local access is not indicated. No user interaction is required (UI:N), and attack complexity is low (AC:L), meaning no race condition or special timing is needed beyond holding a low-privileged credential. Limiting factors: the attacker must already possess OS-level local access or a SQL Server authentication credential, and exploitation does not cross scope boundaries into other systems (S:U). Remote unauthenticated exploitation is not supported by the available data.

The CVSS 7.8 (High) score with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a low-complexity, low-privilege local exploit with complete impact - consistent with a heap overflow reachable by any authenticated user on the SQL Server host. No EPSS score was included in the provided intelligence, so exploitation probability cannot be quantified from that signal. No KEV listing exists, and no POC has been publicly disclosed. The local attack vector meaningfully constrains opportunistic mass exploitation; however, in environments where SQL Server hosts are accessed by multiple lower-privileged users, or where an attacker has already established OS-level or SQL Server login access through another vector, this vulnerability becomes a reliable code execution primitive for privilege escalation or lateral movement. The breadth of affected versions (four major generations, eight distinct build ranges) indicates wide patch exposure across enterprise SQL Server fleets.

A low-privileged SQL Server login holder or local OS user on a vulnerable SQL Server host crafts a query or stored procedure invocation that triggers the heap overflow in an internal SQL Server buffer. The overflow corrupts adjacent heap structures or function pointers, redirecting execution to attacker-controlled code. No user interaction is required and attack complexity is low, yielding code execution in the SQL Server service process context - typically a high-privilege Windows service account - on a successful attempt.