Microsoft SQL Server EUVD-2026-73390

Exploitation requires a valid SQL Server login with at minimum low-privilege access (PR:L per CVSS vector) - unauthenticated external attackers cannot exploit this vulnerability. The attacker must be able to reach the SQL Server over the network, typically via TCP 1433, which in well-configured environments is restricted to application server subnets rather than exposed to untrusted networks. No non-default configuration flag or optional feature appears required; the flaw exists in the core SQL Server engine. Key limiting factors: (1) authentication requirement eliminates anonymous Internet-facing exploitation; (2) network firewall controls between untrusted zones and SQL Server reduce reachable attacker population; (3) only SQL Server 2017-2025 in specific build ranges are affected - organizations on supported, patched SQL Server versions are not exposed.

The CVSS 6.5 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) correctly characterizes a bounded but meaningful risk: network-exploitable with no complexity and high confidentiality impact, but gated by the PR:L requirement - a valid low-privilege SQL Server account. The C:H rating is significant: uninitialized memory in a database server can expose fragments of other users' query results, internal metadata, or cached credential material from co-resident sessions. The absence of integrity or availability impact narrows the concern to data exfiltration. No EPSS data was provided in the input, but with no KEV listing and no public exploit, opportunistic mass exploitation is unlikely; insider threat or post-compromise lateral movement scenarios are the most plausible paths. The breadth of affected versions - four major release branches spanning nearly a decade of SQL Server - means a large installed base remains exposed until patched, and any database environment granting SQL logins to low-trust internal users or application accounts faces tangible risk.

An attacker with a low-privilege SQL Server account - such as an application service account or a compromised internal user - connects to an affected SQL Server instance and submits a crafted T-SQL query designed to trigger the uninitialized memory read path. The server's response contains stale memory contents from a prior operation, potentially including fragments of another session's query results, cached credentials, or internal state data. No public proof-of-concept exists, so reliable exploitation likely requires binary analysis of the patched versus unpatched SQL Server engine to identify the affected code path.