CVE-2026-68779: CWE-125: Out-of-bounds Read in Microsoft Microsoft SQL Server 2017 (CU 31)

This vulnerability involves an out-of-bounds read in Microsoft SQL Server 2017 (CU 31), which can be exploited by an authorized attacker to disclose sensitive information over the network. The CVSS 3.1 vector indicates that the attack requires network access with low complexity and privileges, does not require user interaction, and impacts confidentiality with a high impact rating. Integrity and availability are not affected. Microsoft has released an official fix for this issue.

An authorized attacker can exploit this vulnerability to read memory outside the intended bounds, potentially disclosing sensitive information over the network. There is no impact on system integrity or availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68779 to remediate this vulnerability.