Executive brief
SQL Server, Microsoft's widely-used database platform, contains an out-of-bounds read vulnerability that allows an authenticated attacker to leak sensitive information over the network. While the attacker must have valid database credentials, a successful exploit could expose confidential data stored in the database.
Technical details
An out-of-bounds read vulnerability exists in Microsoft SQL Server that allows an authenticated attacker to read memory beyond intended boundaries. The vulnerability requires valid authentication credentials to exploit, but no user interaction is necessary once authenticated. An attacker with database access can trigger the out-of-bounds read to disclose sensitive information including data in memory, potentially including credentials, encryption keys, or other confidential database contents. The attack vector is network-based, allowing remote exploitation from any network-connected system. Patches are available from Microsoft.
Affected products
- Microsoft SQL Server
Timeline
- 2026-09-08: disclosed