CVE-2026-77485: CWE-416: Use After Free in Microsoft Microsoft SQL Server 2017 (CU 31)

This vulnerability (CVE-2026-77485) is a use-after-free condition in Microsoft SQL Server 2017 and later versions up to certain cumulative update builds. It allows an authorized attacker with local access and low privileges to elevate their privileges on the affected system. The vulnerability has a CVSS 3.1 base score of 7.0, with attack vector local, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. Microsoft has published an official security update to address this issue.

An authorized local attacker can exploit this use-after-free vulnerability to elevate privileges on the affected SQL Server instance. Successful exploitation could lead to full compromise of the database server's confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Microsoft has released official security updates that fix this vulnerability. Users should apply the latest cumulative updates for Microsoft SQL Server 2017 and later versions as indicated in the vendor advisory. No additional mitigations are required beyond applying the official fix.