Microsoft SQL Server EUVD-2026-73385

Exploitation requires an authenticated SQL Server database login with at least low privileges (PR:L per CVSS). No non-default feature enablement or special server configuration is indicated by available descriptions; the flaw appears reachable via standard authenticated SQL connections over the network (AV:N/AC:L). The primary limiting factor is the authentication prerequisite - unauthenticated or anonymous access to SQL Server is not sufficient. Environments that restrict SQL Server network access to dedicated application service accounts and prohibit direct end-user database logins are at materially lower risk.

The CVSS 6.5 (Medium) score reflects a pure confidentiality impact (C:H/I:N/A:N) with no write or denial-of-service primitive. The PR:L requirement is the primary mitigating factor - exploitation demands a valid SQL Server login, ruling out anonymous or pre-authentication attacks. Despite the Medium CVSS, the breadth of affected versions (2017-2025, eight distinct version-branch combinations) combined with SQL Server's ubiquity in enterprise Windows environments creates a significant aggregate attack surface when targeting insider threats, compromised service accounts, or multi-tenant shared-database scenarios. EPSS data is absent from the provided intelligence, and KEV status is not confirmed, so widespread automated exploitation is not currently indicated. Real-world priority is standard patch-cycle for most organizations, escalating to urgent in environments where SQL Server database logins are held by semi-trusted or third-party users.

An attacker holding a low-privilege SQL Server login connects to the database engine over the network and submits a specially crafted query or protocol message that triggers a buffer over-read in the server's processing logic. The over-read returns memory contents adjacent to the intended buffer - potentially including fragments of other sessions' query data, parameter values, or internal heap structures - directly to the attacker's result set. No public proof-of-concept code has been identified at time of analysis.