Executive brief
SQL Server is Microsoft's enterprise relational database system used to store and manage sensitive business data. An authorized attacker with network access can exploit a buffer over-read flaw to read sensitive information from server memory, potentially exposing confidential customer data, credentials, or other protected information without leaving obvious traces.
Technical details
A buffer over-read vulnerability exists in SQL Server that allows an authenticated attacker with network connectivity to read beyond allocated memory boundaries. The flaw is in SQL Server's network communication handling, where insufficient bounds checking on certain operations permits an attacker to disclose unintended memory contents. This vulnerability requires valid authentication credentials to exploit and operates over the network via standard SQL Server protocols. An attacker can extract sensitive data such as encryption keys, authentication tokens, or unencrypted data from memory. Patches are expected to be available from Microsoft.
Affected products
- Microsoft SQL Server
Timeline
- 2026-09-08: disclosed