CVE-2026-67369: CWE-125: Out-of-bounds Read in Microsoft Microsoft SQL Server 2025 (CU8)

This vulnerability (CWE-125) involves an out-of-bounds read in Microsoft SQL Server 2025 (CU8). An attacker with authorized access can exploit this flaw to disclose information over the network. The affected versions are builds from 17.0.0.0 up to but not including 17.0.4085.5 and from 17.0.1050.2 up to but not including 17.0.1135.8. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, no integrity or availability impact, and official remediation level with confirmed fix. Microsoft has published an official advisory with a fix available.

An authorized attacker can exploit this vulnerability to read memory outside the intended bounds, resulting in the disclosure of sensitive information over the network. There is no impact on integrity or availability. The vulnerability requires privileges and network access but no user interaction.

An official fix is available from Microsoft. Users should apply the security updates provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-67369 to remediate this vulnerability.