This vulnerability (CVE-2026-33120) is classified as CWE-822: Untrusted Pointer Dereference in Microsoft SQL Server 2022 (GDR) version 16.0.0. It enables an authorized attacker to execute arbitrary code remotely by exploiting improper handling of pointers. The CVSS v3.1 base score is 8.8, indicating high severity, with network attack vector, low attack complexity, and no user interaction required. Microsoft has issued an official patch to remediate this vulnerability as detailed in their security update guide.

Successful exploitation allows an authorized attacker to execute arbitrary code remotely on the affected Microsoft SQL Server 2022 instance. This can lead to full compromise of confidentiality, integrity, and availability of the server. The vulnerability requires attacker privileges but no user interaction, making it a significant risk in networked environments.

An official fix is available from Microsoft. Users should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33120 to remediate this vulnerability. No additional mitigation actions are indicated by the vendor advisory.