Microsoft SQL Server EUVD-2026-73815

Exploitation requires a valid SQL Server login on the target instance (PR:L - 'authorized attacker' per the description). The vulnerability is reachable over a standard network connection (AV:N, AC:L), meaning no physical access or elevated network position is needed beyond connectivity to the SQL Server port. No special server configuration is required. Exploitation is limited by the authentication requirement: anonymous or unauthenticated users cannot trigger the flaw. The affected scope is SQL Server 2025 only; earlier SQL Server versions (2019, 2022) are not listed as affected.

CVSS 6.5 (Medium) accurately captures the threat profile: the authentication gate (PR:L) meaningfully reduces the attacker pool relative to an unauthenticated flaw, and the impact is confidentiality-only (I:N/A:N), limiting blast radius to information leakage rather than data corruption or service disruption. No EPSS score was provided in the source data, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV and no public exploit code has been identified, placing this in a lower immediate-exploitation tier. The primary concern is insider threat or compromised-credential scenarios where an attacker already holds a SQL Server login and can read adjacent memory contents - potentially including sensitive query results, connection metadata, or transient credentials held in server memory. The C:H rating is appropriate given the unpredictable nature of what an OOB read may expose in a multi-tenant database environment.

An attacker with a valid SQL Server login connects to the target instance over the network (TCP 1433 or configured port) and submits a crafted SQL statement or protocol message that triggers an out-of-bounds read in the server process, causing it to return memory contents from adjacent allocations. The leaked memory may include fragments of other users' query results, connection strings, or other sensitive runtime data depending on heap layout at time of exploitation. No public exploit code is currently known.