Skip to main content

Microsoft SQL Server EUVDEUVD-2026-73382

| CVE-2026-67386 MEDIUM
Use of Uninitialized Resource (CWE-908)
2026-09-08 secure@microsoft.com GHSA-438x-m8qh-h4mv
Information Disclosure Microsoft Sql Server 2017 Sql Server 2019 Sql Server 2022 Sql Server 2025
6.5
CVSS 3.1 · Vendor: microsoft
Share

Severity by source

Vendor (microsoft) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
ENISA EUVD
HIGH
qualitative
vuln.today AI
6.5 MEDIUM

Low-privilege authenticated network access suffices; only confidentiality is impacted with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

3
Analysis Generated
Sep 08, 2026 - 23:09 vuln.today
Patch available
Sep 08, 2026 - 18:35 EUVD
CVE Published
Sep 08, 2026 - 18:18 cve.org
MEDIUM 6.5

DescriptionCVE.org

Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.

AnalysisAI

Uninitialized memory disclosure in Microsoft SQL Server 2017 through 2025 allows a network-connected low-privilege authenticated attacker to read sensitive data from SQL Server memory. The flaw (CWE-908) arises when the engine allocates and uses memory without proper initialization, potentially exposing contents from adjacent queries, sessions, or internal data structures. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid SQL Server database login with at minimum low-privilege access (PR:L per CVSS vector); unauthenticated attackers cannot exploit this vulnerability. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 6.5 rating (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) represents a realistic moderate-high risk: the only barrier to exploitation is possession of a low-privilege database login, which is commonly granted to application service accounts, analysts, or developers in multi-tenant and shared database environments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the vendor-released patches to bring each SQL Server instance within the fixed version range: SQL Server 2017 CU31 to 14.0.3550.4 or later; SQL Server 2017 GDR to 14.0.2130.4 or later; SQL Server 2019 CU32 to 15.0.4490.9 or later; SQL Server 2019 GDR to 15.0.2190.7 or later; SQL Server 2022 CU26 to 16.0.4275.2 or later; SQL Server 2022 GDR to 16.0.1200.5 or later; SQL Server 2025 CU8 to 17.0.4085.5 or later; SQL Server 2025 GDR to 17.0.1135.8 or later. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Sql Server 2017

View all
CVE-2026-21262 HIGH POC
8.8 Mar 10

SQL Server 2016-2025 contains an improper access control flaw that allows authenticated network attackers to escalate pr
CVE-2024-37341 CRITICAL
9.8 Sep 10

Microsoft SQL Server Elevation of Privilege Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is rem
CVE-2024-37980 CRITICAL
9.8 Sep 10

Microsoft SQL Server Elevation of Privilege Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is rem
CVE-2026-77482 HIGH
8.8 Sep 08

Heap-based buffer overflow in Microsoft SQL Server 2017 and 2019 enables unauthenticated network attackers to execute ar
CVE-2026-66819 HIGH
8.8 Sep 08

SQL injection in Microsoft SQL Server enables a low-privileged authenticated attacker to escalate database privileges ov
CVE-2026-67368 HIGH
8.8 Sep 08

Privilege escalation in Microsoft SQL Server 2017 through 2025 allows any low-privileged authenticated database user to

CVE-2026-67639 HIGH
8.8 Sep 08

Heap-based buffer overflow in Microsoft SQL Server 2017 through 2025 enables an authenticated low-privilege network atta
CVE-2026-67380 HIGH
8.8 Sep 08

Remote code execution is possible in Microsoft SQL Server 2017 through 2025 via a heap-based buffer overflow (CWE-122) t
CVE-2026-67370 HIGH
8.8 Sep 08

SQL injection in Microsoft SQL Server (versions 2017 through 2025) enables a network-authenticated low-privilege attacke
CVE-2026-67631 HIGH
8.8 Sep 08

Heap-based buffer overflow in Microsoft SQL Server enables an authenticated, low-privileged network attacker to achieve

CVE-2026-77481 HIGH
8.8 Sep 08

Heap-based buffer overflow in Microsoft SQL Server (versions 2017 through 2025) enables any authenticated network attack
CVE-2026-67384 HIGH
8.8 Sep 08

Remote code execution in Microsoft SQL Server affects versions 2017 through 2025 via an integer overflow that triggers a

Same weakness CWE-908 – Use of Uninitialized Resource

View all
CVE-2011-1255 CRITICAL POC
9.3
CVE-2024-50302 MEDIUM
5.5
CVE-2024-12085 HIGH POC
7.5
CVE-2021-1104 CRITICAL POC
9.8
CVE-2021-29937 CRITICAL POC
9.8
CVE-2021-29936 CRITICAL POC
9.8
CVE-2021-26305 CRITICAL POC
9.8
CVE-2019-9641 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-73382 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy