Microsoft SQL Server EUVD-2026-73383

Exploitation requires a valid SQL Server credential at minimum low-privilege level (PR:L per CVSS) - this can be a SQL authentication login, a Windows/AD account with SQL Server access, or any application-tier credential with a SQL Server role assignment. Anonymous or unauthenticated connections are insufficient. The attacker must have network-level TCP connectivity to the SQL Server TDS port (default 1433). No non-default configuration or special server feature needs to be enabled - the vulnerability is present in the core protocol handling of all affected builds. Limiting factors: (1) at least one low-privilege SQL Server account or equivalent Windows credential must be compromised; (2) network path to port 1433 must exist (perimeter firewalls blocking 1433 are an effective compensating control); (3) the SQL Server build must be in the affected version ranges spanning 2017 through 2025.

The CVSS 8.8 score reflects a network-accessible (AV:N), low-complexity (AC:L) vulnerability requiring only low-privilege authentication (PR:L) with no user interaction. The PR:L requirement moderately constrains the attack surface relative to fully unauthenticated flaws, but SQL Server environments routinely expose numerous low-privileged accounts - application service accounts, reporting users, ETL accounts - any of which would suffice. The full C:H/I:H/A:H impact triad confirms that successful exploitation yields complete server compromise. No EPSS score was supplied, and the absence of a CISA KEV listing and public POC somewhat reduces immediate urgency, yet the breadth of affected versions across four SQL Server generations and the low attack complexity means the window before weaponized exploitation narrows quickly after disclosure. Even a mid-sized database team should treat this as urgent given how widely SQL Server underpins enterprise workloads and the low bar for exploitation once credentials are obtained.

An attacker who has obtained low-privilege SQL Server credentials - through phishing, credential stuffing, or compromise of an application service account - connects directly to the SQL Server TDS listener on TCP port 1433 and transmits a specially crafted protocol message that triggers the heap-based buffer overflow in the server process. The memory corruption yields code execution under the SQL Server service account context, which typically holds broad filesystem privileges and may run as a domain service account, enabling subsequent lateral movement or exfiltration of all hosted databases. No public POC has been identified at time of analysis, but the low attack complexity (AC:L) indicates exploitation is not technically demanding once a proof-of-concept is developed.