Microsoft SQL Server EUVD-2026-73787

Exploitation requires: (1) local access to the system running SQL Server (AV:L - remote network exploitation is not possible); (2) a valid SQL Server login with at minimum low-level database privileges (PR:L - unauthenticated access does not satisfy this); (3) successful exploitation of a high-complexity condition such as a heap race (AC:H - a simple, reliable one-shot exploit is unlikely). Exploitation is limited by: the requirement for an existing authenticated SQL Server session, the need to be operating locally on the host (not via a remote SQL connection to a separate server), and the race-condition complexity that reduces reliability. No user interaction from a victim is required (UI:N). There is no indication this affects only specific non-default SQL Server configurations.

The CVSS 7.0 base score reflects real-world constraints: AV:L requires the attacker to already have local access to the system running SQL Server, PR:L requires an authenticated SQL Server login, and AC:H indicates exploitation is not straightforward - a race condition or specific heap state must be achieved. These factors significantly limit opportunistic exploitation. No KEV listing and no public exploit code further reduce immediate operational risk. Despite the C:H/I:H/A:H impact metrics, the local-only, high-complexity attack path means this is not a remotely exploitable, wormable vulnerability. The primary risk scenario is insider threat or post-compromise lateral movement within environments where SQL Server runs on shared multi-tenant infrastructure. EPSS data was not provided; given the AC:H and local-only vector, exploitation probability is likely low to moderate. Patch prioritization should be driven by whether untrusted or low-privileged users have local OS or SQL Server access.

An attacker who has obtained a low-privilege SQL Server login on a target server - whether through credential theft, brute force, or insider access - crafts specific queries or API calls designed to trigger a race condition in SQL Server's memory allocator, causing freed memory to be reused in a controlled way. By repeating the trigger until the heap layout is favorable, the attacker achieves arbitrary code execution within the SQL Server process and elevates their privileges. No public proof-of-concept code has been identified, making this scenario more likely in the context of a sophisticated insider threat or post-breach privilege escalation than opportunistic attack.