Microsoft SQL Server EUVD-2026-73392

Exploitation requires a valid SQL Server login with at least low-privilege access (PR:L per CVSS:3.1 vector). The attack is reachable over the network (AV:N) from any host that can connect to the SQL Server instance, and requires no user interaction (UI:N). No non-default configuration or special feature flag is indicated as a prerequisite. Exploitation is limited to authenticated principals - unauthenticated network access alone is insufficient. The vulnerability yields only confidentiality impact (C:H); no write capability or denial of service is achievable through this flaw. Organizations that restrict SQL Server network exposure to trusted application tiers and limit low-privilege login proliferation materially reduce exposure beyond the CVSS score alone.

The CVSS 6.5 base score reflects a network-accessible, low-complexity attack constrained by a required low-privilege SQL Server login (PR:L), with high confidentiality impact and no integrity or availability consequence. The PR:L gate meaningfully limits the threat surface to insiders, compromised application service accounts, or attackers who have obtained SQL credentials through prior compromise. No public exploit code has been identified and no CISA KEV listing exists, suggesting exploitation has not been observed at scale. EPSS data was not provided. Real-world priority is elevated by the breadth of affected versions - four major release lines in production environments - and by SQL Server's typical role hosting regulated data (PII, financial, healthcare records) where a confidentiality breach carries compliance consequences even without code execution. The low attack complexity (AC:L) means exploitation effort is minimal for an attacker who already holds valid credentials.

An attacker who has obtained a low-privilege SQL Server login - through credential stuffing, a compromised application service account, or insider access - connects to the SQL Server instance over the network and issues a crafted query or procedure call that triggers the uninitialized memory code path. The server response includes residual memory contents from a prior operation, potentially exposing fragments of other users' query results, session tokens, or internal server state. No public exploit code exists at time of analysis, but the AC:L rating suggests exploitation is straightforward once the triggering query pattern is known.