CVE-2026-88081: CWE-125: Out-of-bounds Read in Microsoft Microsoft SQL Server 2017 (GDR)

CVE-2026-88081 is an out-of-bounds read vulnerability (CWE-125) in Microsoft SQL Server 2017 (GDR) and subsequent versions. It enables an attacker with authorized access to the server to read memory outside the intended bounds, potentially disclosing sensitive information over the network. The vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity, with network attack vector, low attack complexity, and no user interaction required. The vulnerability affects multiple version ranges starting from 14.0.0 up to various fixed versions below 17.0.1145.4. Microsoft has published an official fix for this issue.

An authorized attacker can exploit this vulnerability to read memory beyond allocated bounds, leading to information disclosure over the network. This could expose sensitive data handled by the SQL Server instance. The vulnerability does not allow code execution or denial of service but compromises confidentiality.

An official fix is available from Microsoft. Users should apply the security updates as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88081 to remediate this vulnerability. No additional mitigations are specified by the vendor.