CVE-2026-88086: CWE-125: Out-of-bounds Read in Microsoft Microsoft SQL Server 2019 (GDR)

This vulnerability (CVE-2026-88086) involves an out-of-bounds read in Microsoft SQL Server 2019 (GDR) that can be exploited by an unauthorized attacker to disclose information over an adjacent network. The flaw is categorized under CWE-125. The CVSS 3.1 vector indicates the attack requires adjacent network access with high attack complexity and no privileges or user interaction. The impact is limited to confidentiality loss without integrity or availability impact. Multiple version ranges of Microsoft SQL Server 2019 and subsequent versions are affected. Microsoft has published an official fix to address this vulnerability.

An unauthorized attacker with access to an adjacent network can exploit this vulnerability to read memory outside the intended bounds, leading to information disclosure. There is no impact on integrity or availability. No known exploits are reported in the wild at this time.

Microsoft has released official fixes for this vulnerability. Users should apply the security updates provided by Microsoft for the affected versions of SQL Server 2019 and later. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88086 for detailed patch information and update instructions.