CVE-2026-68778: CWE-125: Out-of-bounds Read in Microsoft Microsoft SQL Server 2017 (CU 31)

This vulnerability involves an out-of-bounds read in Microsoft SQL Server 2017 (CU 31) that can be exploited by an authorized attacker to disclose information remotely. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires privileges, no user interaction, and results in high confidentiality impact without affecting integrity or availability. Microsoft has published an official fix for the affected versions.

An authorized attacker can exploit this vulnerability to disclose sensitive information over the network. There is no impact on integrity or availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users should apply the security updates provided by Microsoft for the affected versions of SQL Server 2017 (CU 31) to remediate this vulnerability. Refer to the Microsoft security advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68778 for detailed patching instructions.