Microsoft SQL Server EUVD-2026-73393

Exploitation requires a valid SQL Server database login with at least low privileges (PR:L per CVSS vector). Network access to the SQL Server listener port is required (AV:N), but no elevated database role, administrative access, or non-default configuration is indicated - the flaw appears present in any standard SQL Server deployment where an attacker holds a valid credential. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning no race condition or specific timing is needed. The primary limiting factor is credential possession: unauthenticated external actors with no database account cannot directly exploit this vulnerability.

The CVSS 6.5 (Medium) score reflects a meaningful but bounded risk profile: network reachability and low attack complexity make triggering the bug straightforward once authenticated, but PR:L is a genuine gatekeeping factor - unauthenticated external attackers cannot exploit this without first obtaining a valid database credential. The C:H/I:N/A:N impact profile confirms exposure is read-only memory disclosure with no write or denial-of-service capability. No EPSS data is provided in the input, KEV status is absent (no confirmed active exploitation), and no POC code has been identified - all of which reduce urgency relative to the raw CVSS score. Real-world priority is moderate: organizations with externally reachable SQL Server instances or environments where low-trust users hold database accounts face a meaningful risk of credential-gated memory leakage. The 'Buffer Overflow' tag applied to this CVE is factually incorrect for a CWE-125 read primitive and may inflate perceived severity during automated triage.

An attacker who has obtained a low-privilege SQL Server account - such as a compromised application service account or a read-only reporting login - sends a specially crafted query over the network that triggers the out-of-bounds read in the SQL Server engine. The engine returns memory contents beyond the intended buffer boundary in its response, potentially exposing fragments of other users' query data, connection metadata, or internal server state. No public exploit code has been identified at time of analysis.