CVE-2026-68781: CWE-125: Out-of-bounds Read in Microsoft Microsoft SQL Server 2017 (CU 31)

This vulnerability (CWE-125) involves an out-of-bounds read in Microsoft SQL Server 2017 and later versions, which can be exploited by an authorized attacker to disclose sensitive information over the network. The flaw affects versions prior to the fixed builds identified by Microsoft. The CVSS 3.1 vector indicates the attack requires network access with low complexity and privileges, no user interaction, and results in high confidentiality impact without affecting integrity or availability. Microsoft has published an official fix to address this issue.

An authorized attacker with network access can exploit this vulnerability to read memory outside the intended bounds, potentially disclosing sensitive information. The impact is limited to confidentiality with no direct impact on integrity or availability. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users should apply the security updates provided by Microsoft for the affected versions of SQL Server to remediate this vulnerability. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68781 for detailed patch information and update instructions.