Microsoft SQL Server EUVD-2026-73314

Exploitation requires a valid SQL Server login with at minimum low privileges (PR:L per CVSS), meaning the attacker must authenticate to the SQL Server instance - anonymous or unauthenticated access is insufficient. No special SQL Server features, non-default configurations, or specific stored procedures need to be enabled; the flaw is in the core engine reachable through normal authenticated query submission. Network access to the SQL Server port (default TCP 1433) is required. Exploitation is limited by the need for valid credentials: attackers without a SQL Server account cannot trigger this remotely. Affected deployments are constrained to SQL Server 2022 (both GDR and CU26 tracks) below the patched build and SQL Server 2025 (CU8 and GDR tracks) below the patched build.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N reflects a medium-severity (6.5) information disclosure requiring a valid low-privileged database account. The high confidentiality impact is plausible given that out-of-bounds reads in database engines can expose sensitive heap or stack memory - potentially including query results, credentials, or encryption keys held in memory - but the scope is uncontained (S:U), meaning impact does not cross a security boundary to another system. No EPSS score, KEV listing, or public POC was provided, making this a vendor-patched, no-known-exploit scenario as of analysis. The low attack complexity (AC:L) and network attack vector (AV:N) mean that any authenticated SQL Server user could exploit this consistently without special timing or race conditions, which raises operational priority for internet-exposed or shared SQL Server instances. Organizations with strict separation of database accounts (each application using its own low-privilege login) face reduced risk compared to environments where multiple tenants share a login.

An attacker with a valid low-privileged SQL Server login - such as a read-only reporting account or a compromised application service account - sends a specially crafted query or protocol message to the SQL Server instance over the network. The malformed input causes the engine to read beyond a valid buffer boundary, returning out-of-bounds memory contents in the server response. The attacker parses the response to extract sensitive data from server memory, which may include cached query results, other users' session data, or internal engine structures.