Microsoft SQL Server EUVD-2026-73822

Exploitation requires a valid SQL Server login with at minimum low-privilege access (corresponding to PR:L in the CVSS vector), consistent with the description's 'authorized attacker' language. Network connectivity to the SQL Server instance (typically TCP 1433) is required (AV:N). No user interaction is needed (UI:N) and no special non-default configuration is indicated - the vulnerability is present in default SQL Server deployments across the affected version ranges. Exploitation is strictly bounded by the authentication requirement: unauthenticated external attackers cannot exploit this directly. Impact is limited to information disclosure (C:H/I:N/A:N); no integrity or availability compromise is achievable via this flaw alone.

CVSS 6.5 Medium (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately represents the risk profile: network-accessible, low complexity, but gated behind authenticated access. The C:H metric is notable - memory disclosure in a database engine process can expose sensitive in-memory data. No EPSS data was provided in the input, and no CISA KEV listing is indicated, meaning active exploitation is unconfirmed. The broad scope across three major SQL Server generations and both servicing tracks (CU and GDR) significantly enlarges the affected surface area; even a mid-sized municipal IT team in boleslawiec running legacy SQL Server 2019 GDR instances should treat patching as urgent given the low attack complexity once credentials are obtained. The input tags include 'Buffer Overflow,' which conflicts with the CWE-125 (Out-of-Bounds Read) classification - this is a read primitive, not a write/overflow, and the mislabel should not inflate risk perception toward code execution scenarios.

An attacker with a valid low-privilege SQL Server login - such as a compromised application service account or shared reporting credential - connects to the instance over the network and submits a crafted query that triggers the out-of-bounds read in the database engine. The server returns adjacent memory contents beyond the intended buffer boundary, potentially disclosing sensitive in-memory data such as query results, cached credentials, or internal server state. No public exploit code has been identified, but the low attack complexity makes this scenario feasible for any authenticated insider or credential-holding adversary.