CVE-2025-47997 MEDIUM

CVE-2025-47997: Microsoft SQL Server Information Disclosure Vulnerability

Vendor Microsoft
Product Microsoft SQL Server 2016 Service Pack 3 (GDR)
Weakness CWE-362
Published September 9, 2025
Last update February 20, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

What the vulnerability does

01Description

Concurrent execution using shared resource with improper synchronization ('race condition') in SQL Server allows an authorized attacker to disclose information over a network.

Key dates

02Disclosure timeline

September 9, 2025 CVE published
February 20, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-32160 Windows Push Notifications Elevation of Privilege Vulnerability CVE-2025-32441 Rack session gets restored after deletion CVE-2026-20814 DirectX Graphics Kernel Elevation of Privilege Vulnerability CVE-2020-15706 GRUB2 contains a race condition leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing. CVE-2021-0247 Junos OS: PTX Series, QFX Series: Due to a race condition input loopback firewall filters applied to interfaces may not operate even when listed in the running configuration.