CVE-2026-68780: CWE-125: Out-of-bounds Read in Microsoft Microsoft SQL Server 2017 (CU 31)

CVE-2026-68780 is a vulnerability classified as CWE-125 (Out-of-bounds Read) in Microsoft SQL Server 2017 (CU 31) and related versions. It allows an authorized attacker to read memory outside the intended bounds, potentially disclosing sensitive information over a network. The vulnerability has a CVSS v3.1 base score of 6.5, with network attack vector, low attack complexity, and requiring privileges but no user interaction. Microsoft has published an official fix for this issue, and no known exploits are reported in the wild.

An authorized attacker can exploit this vulnerability to read memory beyond intended boundaries, leading to information disclosure over the network. This could expose sensitive data handled by the SQL Server instance. There is no impact on integrity or availability reported.

An official fix is available from Microsoft. Users should apply the security updates provided by Microsoft for the affected versions of SQL Server to remediate this vulnerability. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68780 for detailed patch information and guidance.