Microsoft SQL Server EUVD-2026-73389

Exploitation requires a valid SQL Server 2025 login with at minimum basic connection privileges, as confirmed by the CVSS PR:L metric and the description's 'authorized attacker' framing. The CVSS AV:N/AC:L/UI:N metrics confirm the vulnerability is reachable over a standard network connection with no special race conditions, non-default configurations, or user interaction required beyond the initial authenticated session. Limiting factors: an attacker must first possess or obtain a valid SQL Server credential; the scope is unchanged (S:U), so the exploit does not inherently break out of the SQL Server process boundary to directly compromise adjacent systems, though code execution as the service account may enable subsequent lateral movement depending on environment privilege configuration. Both the GDR and CU8 branch installations within the stated version ranges are affected on x64 Windows platforms.

The CVSS 8.8 base score reflects a network-exploitable vulnerability with low authentication bar and full confidentiality, integrity, and availability impact (C:H/I:H/A:H). The AC:L metric signals no race conditions, non-default settings, or timing dependencies are required once an authenticated session is established. The absence of a CISA KEV listing and public proof-of-concept moderates immediate urgency slightly, but the combination of network reachability, heap-RCE impact class, and a single low-privilege credential as the only barrier means that once reliable exploit code is developed, attack automation becomes straightforward - even a mid-sized municipal IT team in zabrze should treat this as an urgent patching item rather than a next-maintenance-cycle deferral. EPSS data was not included in the provided input, leaving exploitation probability unquantified, but heap buffer overflows in widely-deployed database engines historically attract rapid weaponization. No conflicts exist between the CVSS vector and the description; the 'authorized attacker' framing in the description aligns precisely with PR:L.

An attacker who has obtained a low-privilege SQL Server login - via credential stuffing, a compromised application service account, or internal access - connects to the database engine over the network and sends a specially crafted query or protocol message that triggers the heap buffer overflow. The overflow corrupts adjacent heap structures to redirect execution, allowing the attacker to run arbitrary code under the SQL Server service account context, potentially gaining full read/write access to all hosted databases and lateral movement capability within the environment. No public exploit code has been identified at time of analysis.