Product:
SQL Server
Summary
Concurrent execution using shared resource with improper synchronization leads to a race condition in SQL Server. This vulnerability allows an authorized attacker to disclose sensitive information over a network. The issue arises from inadequate synchronization mechanisms when accessing shared resources.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2025-47997 |
Exploitation
To exploit this vulnerability, an attacker must have authorized access to the SQL Server. By executing concurrent operations that access shared resources without proper synchronization, the attacker can manipulate the execution flow to disclose sensitive information. This can be achieved by crafting specific queries or operations that trigger the race condition.
Affected Products
- SQL Server: Vulnerable to race condition allowing information disclosure over a network.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Microsoft. Additionally, implementing proper synchronization mechanisms in applications that interact with SQL Server can help prevent unauthorized information disclosure.