A heap-based buffer overflow vulnerability in Microsoft SQL Server 2025 creates a high-severity risk of remote code execution for authenticated users.

The vulnerability is a heap-based buffer overflow (CWE-122) that can be triggered by an authenticated attacker over a network. The CVSS vector (PR:L) confirms that valid credentials are required to initiate the attack sequence.

Successful exploitation allows an attacker with low privileges to execute arbitrary code on the database server. This could lead to a total compromise of the database environment, including unauthorized access to sensitive data, modification of records, or complete system takeover, resulting in significant operational downtime and potential regulatory non-compliance. The CVSS score of 8.8 reflects the high potential for impact on confidentiality, integrity, and availability.

Immediate Action: Apply the vendor-supplied security updates immediately: update to version 17.0.4085.5 for CU8 or 17.0.1135.8 for the GDR branch.

Proactive Monitoring: Review SQL Server error logs and authentication logs for anomalous activity or unexpected crashes that may indicate exploitation attempts.

Compensating Controls: Ensure that access to the SQL Server is restricted to authorized personnel and utilize network segmentation to limit the exposure of database ports to untrusted segments.

Public Exploit Available: No (exploit_available: false)

Given the potential for complete system compromise via remote code execution, this vulnerability should be treated as a priority for all database administrators. Organizations must verify their current versioning against the provided fixed releases and schedule an emergency maintenance window to apply the necessary patches.