Executive brief
Microsoft SQL Server contains a buffer over-read vulnerability that allows an authenticated attacker to read sensitive information from server memory and transmit it over the network. While the attacker must have valid database credentials, successful exploitation could expose confidential data including query results, encryption keys, or other sensitive server state without requiring user interaction or elevated privileges.
Technical details
A buffer over-read vulnerability exists in Microsoft SQL Server's memory handling. The flaw is triggered during network communication when an authorized attacker sends specially crafted requests, causing the server to read beyond allocated buffer boundaries. The vulnerability requires valid authentication credentials to exploit. An attacker can leverage this to disclose sensitive information resident in SQL Server memory that would normally be protected. A patch is expected to be available through Microsoft's security updates.
Affected products
- Microsoft SQL Server <UNKNOWN>
Timeline
- 2026-09-08: disclosed