CVE-2025-49718: Microsoft SQL Server Information Disclosure Vulnerability
Published Jul 8, 2025
·Updated
Microsoft SQL Server Information Disclosure Vulnerability
Other sources
Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network.
— Microsoft
Affected Software
10 affected componentsFixes available
Microsoft SQL Server 2019 (CU 32)
Microsoft SQL Server 2019
Microsoft SQL Server 2022 (CU 19)
Microsoft SQL Server 2022
Microsoft SQL Server 2019>=15.0.2000.5<15.0.2135.5
Microsoft SQL Server 2019>=15.0.4003.23<15.0.4435.7
Microsoft SQL Server 2022>=16.0.1000.6<16.0.1140.6
Microsoft SQL Server 2022>=16.0.4003.1<16.0.4200.1
Microsoft SQL Server 2022 (CU 19)
Microsoft SQL Server 2022
Event History
Jul 8, 2025
CVE Published
via Microsoft·07:00 AM
Data Sourced
via Microsoft·07:00 AM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·07:00 AM
Affected Software
Updated
via Microsoft·07:00 AM
Description
CVE Published
via MITRE·04:58 PM
Data Sourced
via MITRE·04:58 PM
DescriptionSeverity
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-49718?
CVE-2025-49718 has a medium severity level as it allows unauthorized information disclosure.
2
How do I fix CVE-2025-49718?
To fix CVE-2025-49718, apply the latest security patches provided by Microsoft for SQL Server 2019 or SQL Server 2022.
3
What are the affected versions for CVE-2025-49718?
CVE-2025-49718 affects Microsoft SQL Server 2019 and SQL Server 2022 across specific builds.
4
Can CVE-2025-49718 be exploited remotely?
Yes, CVE-2025-49718 can be exploited by an unauthorized attacker over a network to disclose sensitive information.
5
Is there a workaround for CVE-2025-49718?
Currently, the primary recommendation for CVE-2025-49718 is to apply the appropriate security updates, as no specific workarounds are indicated.