A buffer over-read vulnerability has been identified in Microsoft SQL Server. This issue allows an authorized attacker to disclose information by reading small portions of heap memory over the network. The vulnerability affects several versions of SQL Server, including SQL Server 2025, 2022, 2019, and 2017, as well as SQL Server 2016 with the Azure Connect Feature Pack.
Exploitation of this vulnerability could lead to unauthorized information disclosure, allowing attackers to read sensitive data from memory.
Users can apply the security update for their specific version of SQL Server. Detailed instructions for downloading and installing these security updates are available in the Microsoft SQL Server Security Update Guide. For SQL Server 2025, both GDR and CU6 update options are available. SQL Server instances on Windows Azure (IaaS) can also receive these security updates.
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.
