6.5
Medium
CVE-2026-54116 Access of resource using incompatible type ('type confusion') in SQL Server allows an authorized attacker to disclose…
Description
Access of resource using incompatible type ('type confusion') in SQL Server allows an authorized attacker to disclose information over a network.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft SQL Server 2025 (CU 6) 17.0 | earliest → < 17.0.4060.2 | 17.0.4060.2 |
| Microsoft SQL Server 2025 for x64-based Systems (GDR) 17.0 | 17.0.1050.2 → < 17.0.1125.2 | 17.0.1125.2 |
References
- Microsoft SQL Server Information Disclosure Vulnerability msrc.microsoft.com
Timeline
- Published
- Last modified
Other CVEs of Microsoft SQL Server 2025 (CU 6)
The 8 CVEs of Microsoft SQL Server 2025 (CU 6) →
CVE-2026-47297
Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network
8.1
High
CVE-2026-50468
Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network
6.5
Medium
CVE-2026-47295
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an…
8.8
High
CVE-2026-55002
External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network
8.8
High