Microsoft Sql Server 2025 For X64 Based Systems Gdr
Monthly
Type confusion (CWE-843) in Microsoft SQL Server 2025 enables authenticated, low-privileged network attackers to disclose sensitive server-side information. The CVSS vector (AV:N/PR:L/C:H) confirms that any authorized database user - regardless of their data access permissions - can potentially trigger the flaw remotely with no user interaction required. No public exploit code or CISA KEV listing exists at time of analysis, but the high confidentiality impact and low access complexity make patching a meaningful priority for organizations running SQL Server 2025.
Buffer over-read in Microsoft SQL Server 2025 exposes server memory contents to low-privileged authenticated attackers over the network, resulting in high confidentiality impact with no integrity or availability consequences. Both the Cumulative Update 6 (CU 6) and General Distribution Release (GDR) servicing tracks on x64-based systems are confirmed affected per vendor CPE data. No public exploit has been identified and CISA has not listed this in KEV; SSVC assessment corroborates no active exploitation at time of analysis, placing this in a measured but real priority category for environments handling sensitive SQL data.
Privilege elevation in Microsoft SQL Server (2016 SP3 through 2025) allows an authenticated attacker to inject crafted SQL commands over the network and gain higher database privileges (CVSS 8.8). The flaw is a classic improper neutralization of special elements (CWE-89) reachable by any principal already holding low-level database access. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, though a vendor patch is available.
Privilege escalation via external file path control in Microsoft SQL Server affects versions 2016 through 2025, exploitable by any low-privilege authenticated SQL Server user. CWE-73 (External Control of File Name or Path) allows an authorized attacker to supply or manipulate file path parameters - likely through SQL operations such as BULK INSERT, BACKUP/RESTORE, or FILESTREAM commands - to escape intended access boundaries and elevate local operating system or SQL Server privileges. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; however, the SSVC framework rates Technical Impact as total, indicating full system compromise is achievable upon successful exploitation. The EPSS score of 0.24% (15th percentile) reflects low current exploitation probability.
Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) allows an authenticated, low-privileged attacker to run arbitrary code on the database server by sending crafted data that the engine deserializes unsafely (CWE-502). Any account able to submit queries or data over the network to a vulnerable instance can achieve full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 8.8 rating and the RCE-with-low-privilege profile make it a high-priority patch.
Remote code execution in Microsoft SQL Server 2025 (CU6 and the x64 GDR branch) lets an authenticated attacker run arbitrary code across the network by supplying maliciously crafted serialized data that the server deserializes without validation (CWE-502). The flaw was reported by Microsoft, carries a CVSS 3.1 base score of 8.8, and a vendor patch is available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection in Microsoft SQL Server (versions 2016 through 2025) enables an authenticated attacker to escalate privileges on the database server. The flaw, tracked as CWE-89, exists within the SQL Server engine's handling of user-supplied SQL input, allowing insufficient neutralization to be leveraged for privilege elevation. Publicly available exploit code exists (GitHub gist), though CISA has not yet added this to the KEV catalog and SSVC indicates no confirmed active exploitation; EPSS sits at 0.57% (44th percentile), suggesting low but non-trivial opportunistic exploitation risk.
Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) lets an authenticated attacker with low-privilege database access run arbitrary code on the server via external control of a file name or path (CWE-73). The CVSS 3.1 base score is 8.8 with high impact to confidentiality, integrity, and availability; publicly available exploit code exists, though the flaw is not on CISA KEV and EPSS remains very low (0.06%, 20th percentile), indicating minimal observed exploitation to date. Microsoft has released patched builds across all affected branches.
SQL injection in Microsoft SQL Server 2016-2025 allows authenticated high-privilege attackers to elevate privileges locally via improper neutralization of SQL command elements. Affected versions include SQL Server 2016 SP3, 2017, 2019, 2022, and 2025 across multiple cumulative updates and GDR releases. The CVSS 6.7 score reflects the requirement for high-privilege authentication and local attack vector, but the high confidentiality, integrity, and availability impact makes this a material risk f
SQL injection in Microsoft SQL Server 2016-2025 allows authenticated high-privilege attackers to elevate privileges locally through improper neutralization of special elements in SQL commands. Affected versions span SQL Server 2016 SP3 through 2025, with patch available from Microsoft. Attack requires local access and high-privilege credentials (PR:H in CVSS vector), limiting real-world impact to insider threats or compromised administrative accounts; CVSS 6.7 reflects high confidentiality, integrity, and availability impact but constrained by authentication and local-only attack vector.
Type confusion (CWE-843) in Microsoft SQL Server 2025 enables authenticated, low-privileged network attackers to disclose sensitive server-side information. The CVSS vector (AV:N/PR:L/C:H) confirms that any authorized database user - regardless of their data access permissions - can potentially trigger the flaw remotely with no user interaction required. No public exploit code or CISA KEV listing exists at time of analysis, but the high confidentiality impact and low access complexity make patching a meaningful priority for organizations running SQL Server 2025.
Buffer over-read in Microsoft SQL Server 2025 exposes server memory contents to low-privileged authenticated attackers over the network, resulting in high confidentiality impact with no integrity or availability consequences. Both the Cumulative Update 6 (CU 6) and General Distribution Release (GDR) servicing tracks on x64-based systems are confirmed affected per vendor CPE data. No public exploit has been identified and CISA has not listed this in KEV; SSVC assessment corroborates no active exploitation at time of analysis, placing this in a measured but real priority category for environments handling sensitive SQL data.
Privilege elevation in Microsoft SQL Server (2016 SP3 through 2025) allows an authenticated attacker to inject crafted SQL commands over the network and gain higher database privileges (CVSS 8.8). The flaw is a classic improper neutralization of special elements (CWE-89) reachable by any principal already holding low-level database access. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, though a vendor patch is available.
Privilege escalation via external file path control in Microsoft SQL Server affects versions 2016 through 2025, exploitable by any low-privilege authenticated SQL Server user. CWE-73 (External Control of File Name or Path) allows an authorized attacker to supply or manipulate file path parameters - likely through SQL operations such as BULK INSERT, BACKUP/RESTORE, or FILESTREAM commands - to escape intended access boundaries and elevate local operating system or SQL Server privileges. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; however, the SSVC framework rates Technical Impact as total, indicating full system compromise is achievable upon successful exploitation. The EPSS score of 0.24% (15th percentile) reflects low current exploitation probability.
Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) allows an authenticated, low-privileged attacker to run arbitrary code on the database server by sending crafted data that the engine deserializes unsafely (CWE-502). Any account able to submit queries or data over the network to a vulnerable instance can achieve full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 8.8 rating and the RCE-with-low-privilege profile make it a high-priority patch.
Remote code execution in Microsoft SQL Server 2025 (CU6 and the x64 GDR branch) lets an authenticated attacker run arbitrary code across the network by supplying maliciously crafted serialized data that the server deserializes without validation (CWE-502). The flaw was reported by Microsoft, carries a CVSS 3.1 base score of 8.8, and a vendor patch is available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection in Microsoft SQL Server (versions 2016 through 2025) enables an authenticated attacker to escalate privileges on the database server. The flaw, tracked as CWE-89, exists within the SQL Server engine's handling of user-supplied SQL input, allowing insufficient neutralization to be leveraged for privilege elevation. Publicly available exploit code exists (GitHub gist), though CISA has not yet added this to the KEV catalog and SSVC indicates no confirmed active exploitation; EPSS sits at 0.57% (44th percentile), suggesting low but non-trivial opportunistic exploitation risk.
Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) lets an authenticated attacker with low-privilege database access run arbitrary code on the server via external control of a file name or path (CWE-73). The CVSS 3.1 base score is 8.8 with high impact to confidentiality, integrity, and availability; publicly available exploit code exists, though the flaw is not on CISA KEV and EPSS remains very low (0.06%, 20th percentile), indicating minimal observed exploitation to date. Microsoft has released patched builds across all affected branches.
SQL injection in Microsoft SQL Server 2016-2025 allows authenticated high-privilege attackers to elevate privileges locally via improper neutralization of SQL command elements. Affected versions include SQL Server 2016 SP3, 2017, 2019, 2022, and 2025 across multiple cumulative updates and GDR releases. The CVSS 6.7 score reflects the requirement for high-privilege authentication and local attack vector, but the high confidentiality, integrity, and availability impact makes this a material risk f
SQL injection in Microsoft SQL Server 2016-2025 allows authenticated high-privilege attackers to elevate privileges locally through improper neutralization of special elements in SQL commands. Affected versions span SQL Server 2016 SP3 through 2025, with patch available from Microsoft. Attack requires local access and high-privilege credentials (PR:H in CVSS vector), limiting real-world impact to insider threats or compromised administrative accounts; CVSS 6.7 reflects high confidentiality, integrity, and availability impact but constrained by authentication and local-only attack vector.