Microsoft SQL Server EUVD-2026-73391

Exploitation requires a valid SQL Server login with at least low-level database privileges (PR:L per CVSS vector); no administrative or sysadmin role is needed. The vulnerable code path is reachable over the network via standard SQL Server client protocols on TCP/1433 (default) without requiring local console access or any user interaction on the server. No non-default feature enablement or special server configuration is described as a prerequisite - any SQL Server instance in the affected version ranges listening on the network is potentially vulnerable to any authenticated client. The primary limiting factor is credential acquisition: an attacker must first obtain a valid database login through credential theft, phishing, brute force, or credential reuse before triggering the overflow, which prevents fully unauthenticated automated exploitation.

The CVSS 8.8 score with AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a high real-world risk: the attack path is network-accessible at low complexity, requires only a low-privileged SQL Server credential, and achieves full confidentiality, integrity, and availability compromise. The broad affected version range (four major releases, eight version/track combinations spanning 2017-2025) creates a large exposed population given SQL Server's widespread enterprise deployment. The PR:L requirement prevents fully unauthenticated automated mass exploitation, meaningfully limiting opportunistic scanning campaigns; however, it does not protect against credential-equipped attackers operating post-breach or through credential reuse. No public exploit code exists at time of analysis, and the vulnerability is not in the CISA KEV catalog, which moderates immediate urgency. Given SQL Server's common deployment with elevated service account privileges on Windows, successful exploitation frequently yields SYSTEM-level access, amplifying the real-world impact beyond what S:U alone suggests.

An attacker who has obtained a low-privileged SQL Server credential - through phishing, credential reuse from a prior breach, or brute force of a weak password - connects to the SQL Server instance over TCP/1433 from any network-reachable host and sends a specially crafted database protocol payload that triggers the heap-based buffer overflow in the engine. The overflow corrupts heap metadata, enabling redirection of code execution to attacker-supplied shellcode or ROP gadget chains. The result is arbitrary code execution in the context of the SQL Server service account, which on most Windows deployments runs as Network Service, Local System, or a domain service account with elevated privileges. No public proof-of-concept code has been identified at time of analysis.