Executive brief
Microsoft SQL Server contains a flaw that allows an authorized user to read data outside of proper memory boundaries, potentially exposing sensitive information. An attacker with valid database credentials can exploit this over the network to retrieve data they should not have access to, risking exposure of confidential business or customer information stored in the database.
Technical details
An out-of-bounds read vulnerability in Microsoft SQL Server permits an authenticated attacker to access memory regions outside the intended data structure bounds. The vulnerability is reachable over the network and requires valid authentication credentials to exploit. By crafting specific requests, an attacker can read arbitrary memory contents, potentially disclosing sensitive data such as encryption keys, other users' data, or internal server information. Microsoft has released patches to address this issue.
Affected products
- Microsoft SQL Server <UNKNOWN>
Timeline
- 2026-09-08: disclosed