Microsoft SQL Server 2017 (CU 31) vulnerability

What happened

Integer underflow (wrap or wraparound) in SQL Server allows an authorized attacker to disclose information locally.

Affected versions

Microsoft SQL Server 2017 (CU 31): 14.0.0 through before 14.0.3550.4 (custom); 14.0.0 through before 14.0.2130.4 (custom); 15.0.0.0 through before 15.0.4490.9 (custom); 15.0.0 through before 15.0.2190.7 (custom); 16.0.0.0 through before 16.0.4275.2 (custom); 16.0.0 through before 16.0.1200.5 (custom); 17.0.0.0 through before 17.0.4085.5 (custom); 17.0.1050.2 through before 17.0.1135.8 (custom) Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

• Apply vendor-provided updates or mitigations.
• Review affected product exposure and access logs.