Microsoft SQL Server EUVD-2026-73395

Exploitation requires a valid SQL Server login with at minimum low-privileged database access (PR:L per CVSS vector); unauthenticated exploitation is not possible. The attacker must have network-level connectivity to the SQL Server instance on its listening port. No special SQL Server features, non-default configurations, or elevated roles are required beyond a basic authenticated session. Limiting factors: valid SQL Server credentials must be obtained beforehand (via credential theft, brute force, or compromised application account); no scope change occurs (S:U), so impact is confined to the SQL Server process memory and does not directly pivot to the OS or other systems.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N yields a 6.5 (Medium), reflecting that exploitation is straightforward once an attacker has any SQL Server login - no elevated permissions, no user interaction, and no special configuration are required. The high confidentiality impact (C:H) is the principal concern, as an attacker could potentially read sensitive memory contents including query data, cached credentials, or internal state. No EPSS score was provided, and there is no CISA KEV listing, indicating no confirmed or widespread active exploitation at time of analysis. No POC has been identified. The PR:L constraint is the primary limiting factor: attackers must possess at least a low-privileged database account, which substantially narrows the realistic threat surface compared to unauthenticated flaws. In environments with tight database credential controls, this risk is manageable; in environments with shared or weakly-protected SQL Server accounts, the risk is meaningfully elevated.

An attacker with a low-privileged SQL Server account (e.g., a read-only reporting user or a compromised application service account) connects to an unpatched SQL Server instance over the network and sends a crafted query or protocol message designed to trigger the out-of-bounds read. The server returns memory contents adjacent to the intended buffer, potentially leaking query fragments, cached data, or internal SQL Server state. No POC has been identified, but the low attack complexity suggests exploitation would be straightforward given a valid credential.