Microsoft SQL Server EUVD-2026-73396

Exploitation requires a valid SQL Server login with at least low-privilege access (PR:L per CVSS vector); unauthenticated external attackers cannot directly trigger this flaw. Network reachability to the SQL Server instance (default TCP 1433) is required. Attack complexity is low (AC:L), meaning no race condition, heap-grooming, or timing prerequisite is described. No specific SQL Server feature, non-default configuration, or particular deployment mode beyond network-accessible SQL Server with authenticated users is identified as a prerequisite. Limiting factors are: authentication (a valid credential is required), and no integrity or availability impact constrains attacker incentive to information disclosure only.

The CVSS base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects moderate-to-elevated real-world risk. The primary attack prerequisite - a valid low-privilege SQL Server login - is a meaningful barrier, but SQL Server environments frequently grant broad authenticated access to application service accounts, analysts, and developers, widening the realistic attacker pool. The C:H impact indicates potentially significant memory disclosure, which could expose in-flight query result sets, cached connection metadata, or internal data structures depending on allocation layout at the time of exploitation. No EPSS data was provided in the input, KEV listing is absent, and no POC or public exploit has been reported, which collectively reduce urgency compared to actively exploited or unauthenticated flaws. However, the breadth of affected versions - four major SQL Server generations across eight distinct build targets - means most enterprise estates running unpatched SQL Server are exposed. The absence of integrity or availability impact (I:N/A:N) bounds the worst-case scenario to data leakage rather than service disruption or data corruption.

An attacker holding a low-privilege SQL Server login - such as a compromised application service account or a shared read-only analyst credential - sends a crafted query or protocol message that triggers the out-of-bounds read in the server's network-facing processing component. The server reads beyond the intended buffer and returns adjacent memory contents in the response, potentially disclosing data from other sessions or internal structures. No public exploit code exists at the time of analysis, so exploitation likely requires knowledge of the specific vulnerable code path.