CVE-2026-67630: CWE-125: Out-of-bounds Read in Microsoft Microsoft SQL Server 2017 (CU 31)

This vulnerability, identified as CWE-125 (Out-of-bounds Read), exists in Microsoft SQL Server 2017 and later versions up to certain cumulative updates. It allows an attacker with authorized access to perform an out-of-bounds read, potentially disclosing sensitive information over the network. The vulnerability does not impact integrity or availability but has a high impact on confidentiality. Microsoft has published an official fix to address this issue.

An authorized attacker can exploit this vulnerability to read memory outside the intended bounds, leading to disclosure of sensitive information over the network. There is no impact on data integrity or system availability. The vulnerability requires low attack complexity and privileges but no user interaction.

An official fix is available from Microsoft. Users should apply the security updates provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-67630 to remediate this vulnerability.