CVE-2025-47997: SQL Server 2016 Race Condition Vulnerability

CVE-2025-47997 Overview

CVE-2025-47997 is an information disclosure vulnerability in Microsoft SQL Server caused by a race condition [CWE-200]. The flaw involves concurrent execution using a shared resource with improper synchronization. An authorized attacker with low privileges can exploit the timing window to disclose sensitive information over a network. Microsoft released a security update through its Security Response Center to remediate the issue. The vulnerability affects Microsoft SQL Server 2016, 2017, 2019, and 2022 on x64 platforms. Exploitation requires high attack complexity because the attacker must successfully win the race condition.

Critical Impact
An authenticated attacker who wins the race condition can read sensitive information from SQL Server memory over the network without user interaction.

Affected Products

Microsoft SQL Server 2016 (x64)
Microsoft SQL Server 2017 (x64)
Microsoft SQL Server 2019 (x64)
Microsoft SQL Server 2022 (x64)

Discovery Timeline

2025-09-09 - CVE-2025-47997 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47997

Vulnerability Analysis

The vulnerability is a race condition in SQL Server that results in information disclosure. Concurrent threads access a shared resource without proper synchronization primitives. An authorized attacker can time overlapping requests to observe transient states of memory or data structures that should not be exposed. Successful exploitation returns information the attacker is not authorized to read. The attack is network-reachable and requires authenticated access to the SQL Server instance, along with precise timing.

The weakness maps to [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). Because the race window is narrow, exploitation typically requires repeated attempts and controlled workload conditions. The vulnerability does not permit modification of data or denial of service based on the impact scope.

Root Cause

The root cause is improper synchronization when multiple execution threads access a shared resource inside SQL Server. Without adequate locking or atomic operations, the resource can transition through intermediate states visible to a concurrent caller. Microsoft has not published the specific code path, but the CWE-200 mapping confirms that the race exposes sensitive data rather than corrupting it.

Attack Vector

An attacker must hold a low-privilege authenticated session on the target SQL Server instance. The attacker issues concurrent queries or operations designed to interleave with a targeted internal operation. When the race is won, the response reveals information tied to the shared resource. No user interaction is required, and the attack originates over the network against the SQL Server listener.

No public proof-of-concept exploit is available at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Microsoft Security Update CVE-2025-47997 advisory for vendor guidance.

Detection Methods for CVE-2025-47997

Indicators of Compromise

High-frequency, concurrent query patterns from a single authenticated principal targeting the same object or stored procedure.
Repeated authentication events from a low-privilege SQL account followed by bursts of parallel sessions.
Anomalous query responses containing data outside the caller's normal access footprint recorded in SQL audit logs.

Detection Strategies

Enable SQL Server Audit and capture SCHEMA_OBJECT_ACCESS_GROUP and DATABASE_PRINCIPAL_IMPERSONATION_GROUP events for sensitive databases.
Monitor Extended Events sessions for unusual concurrency on the same object, especially spikes in parallel sp_executesql or ad-hoc batches from a single login.
Correlate SQL Server error log entries and login history with network flow data to identify accounts issuing timing-sensitive query patterns.

Monitoring Recommendations

Baseline query concurrency per login and alert on deviations that suggest race-condition exploitation attempts.
Forward SQL audit logs to a central SIEM or data lake for retention and cross-source correlation.
Track patch state of SQL Server hosts through configuration management to detect unpatched instances exposed to the network.

How to Mitigate CVE-2025-47997

Immediate Actions Required

Apply the Microsoft security update referenced in MSRC advisory CVE-2025-47997 to all affected SQL Server 2016, 2017, 2019, and 2022 instances.
Inventory SQL Server hosts and prioritize internet-exposed and multi-tenant instances for patching.
Rotate credentials for any low-privilege SQL logins that were exposed to untrusted networks prior to patching.

Patch Information

Microsoft has published a security update for each supported branch of SQL Server through the Security Update Guide. Administrators should apply the cumulative update or GDR package matching their installed build. Refer to the Microsoft Security Update CVE-2025-47997 page for build numbers and download links.

Workarounds

Restrict network access to SQL Server TCP endpoints using firewall rules so only trusted application servers can connect.
Enforce least privilege on SQL logins and remove unused accounts that could be leveraged for authenticated exploitation.
Require TLS for SQL Server client connections and place database servers behind a segmented network zone until patches are deployed.

bash

# Configuration example: restrict SQL Server TCP 1433 to trusted subnets on Windows
New-NetFirewallRule -DisplayName "SQL Server - Trusted App Tier Only" `
  -Direction Inbound -Protocol TCP -LocalPort 1433 `
  -RemoteAddress 10.20.30.0/24 -Action Allow

New-NetFirewallRule -DisplayName "SQL Server - Block Other" `
  -Direction Inbound -Protocol TCP -LocalPort 1433 `
  -Action Block