CVE-2025-59250: microsoft jdbc_driver_for_sql_server Improper Input Validation
CVSS: 8.1v3.1HighAnalyzed
AliasesCGA-26jv-mrcw-hv2mCGA-26vq-j3rf-hh94CGA-277g-g5m6-8wwjCGA-296m-mj4j-8qvvCGA-2c8m-2w8v-3w8fCGA-2gvr-mmj5-wxvhCGA-378p-29j5-w9m6CGA-37qr-wpgp-78jxCGA-3jhv-xjgc-q96rCGA-3mvq-9565-g936CGA-3xgv-gwf9-r978CGA-43x5-7jwj-4r9fCGA-4wfg-4xpg-5mxhCGA-57wr-7rq4-rc36CGA-592x-532g-f6pwCGA-6jpr-p5h4-w44rCGA-6m86-5f4p-mw6cCGA-6vh7-h6p9-4wr3CGA-7f8r-vq76-4fvcCGA-7x4g-hpgh-3w55CGA-892q-8w2m-22m3CGA-9959-fmxh-fmmgCGA-9pj8-f6jq-q5vxCGA-c2m4-2852-r95qCGA-f95w-359m-2f63CGA-g486-3v35-2mx2CGA-g4wc-3v2f-6v7xCGA-gmmp-722w-2c2hCGA-jggx-v6p9-7x6vCGA-jrpv-42r2-wwqcCGA-jxm7-96hx-994hCGA-p2vw-h55x-pgw3CGA-pf5m-gvq7-275mCGA-pjcq-gm5w-wj86CGA-q6hx-fx4j-3v8jCGA-q7cp-ff5f-mc34CGA-qh3j-9x79-gqvmCGA-qh6x-8jrp-4hrvCGA-r39m-qp5c-g6prCGA-vc9p-3c33-hrgxCGA-vhh7-f8j2-w3gmCGA-vqmx-2gcg-3xqgCGA-vrc6-6748-9mw3CGA-vvv2-2fcv-xcvpCGA-w929-j3r3-5pgwCGA-wpxr-j5w6-62fqCGA-x2g4-vrfm-xr28CGA-x4wv-j9cq-75r7CGA-xppw-rpm9-vp3wCGA-2hp5-m3r8-jj6vCGA-5fjj-q4ph-3j54CGA-5qfv-7xpw-6x48CGA-632x-9wm2-rm34CGA-652h-949g-r4m7CGA-6g9w-x3g7-2pjpCGA-6wvp-8v23-4hmpCGA-7498-5x5x-7x48CGA-7jcf-5hjh-vw8qCGA-7vr5-x6ww-rhqvCGA-826q-g9pq-4q2gCGA-85v3-q4h5-86ppCGA-9j4c-w2fh-7m83CGA-cv4f-2rgr-fr72CGA-g4f9-mfpx-6vx6CGA-g993-rhp2-cvw6CGA-gv9j-8965-vg6wCGA-h2f5-78w6-3439CGA-hxxw-p3f4-rgmqCGA-j2f5-c6w6-xj9cCGA-j5v6-4g65-h89gCGA-j7vh-pcfj-hv47CGA-j8g7-mx7j-2rrwCGA-jw7v-xrp9-jrpxCGA-pm2v-7xrc-673wCGA-pmx3-99x3-54vpGHSA-m494-w24q-6f7wCGA-qqcr-v8pm-w4m3CGA-qvgr-95f8-g2j6CGA-r4g9-q73h-g539CGA-r86g-28jx-p5p3CGA-rffg-52fh-992wCGA-rhpv-9hhv-5jj3CGA-rrm9-c9xv-5r5hCGA-rwh9-p9jf-frr9CGA-rx2v-h27j-h52pCGA-ww5c-92hw-hvwqCGA-xc89-6737-33wjCGA-xmrg-vqpj-f2gv
Published 14-10-2025Last modified 26-02-2026
Vulnerability summary
CVE-2025-59250 is a high (CVSS 8.1) Improper Input Validation vulnerability in microsoft jdbc_driver_for_sql_server. EPSS estimates a 0.73% chance of exploitation in the next 30 days, higher than 53.5% of scored vulnerabilities.
CVSS score
8.1/10
010
High · v3.1 (CVE.org)EPSS score
0.73%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 4Timeline
- 14-10-2025PublishedVulnerability first disclosed.
- 26-02-2026Last modifiedVulnerability information updated.
Description
Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.
CVSS metrics
5 scores · 5 sources · 1 versionHigh 8.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:CSourcesAll 5 agree
- OSV · WolfiEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- OSV · MavenEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.73%
Chance of exploitation in the next 30 days
Percentile
54%
Versus all other CVEs
30-day change
0.00 pp
From 0.73% on 18-09-2026
18-09-202618-10-2026
EPSS score0.73%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard33 products
- apache-hop< 2.15.0-r14
- apache-hop-fips< 2.15.0-r16
- apicurio-registry< 3.1.4-r2
- apicurio-registry-nginx-config< 3.1.4-r2
- apicurio-registry-ui< 3.1.4-r2
Wolfi20 products
- apicurio-registry< 3.1.4-r2
- apicurio-registry-nginx-config< 3.1.4-r2
- apicurio-registry-ui< 3.1.4-r2
- dependency-trackAll versions (No fix recorded) | < 4.13.6-r0
- dependency-track-bundledAll versions (No fix recorded)
Microsoft9 products
- jdbc_driver_for_sql_server≥ 10.2.0, < 10.2.4 | ≥ 11.2.0, < 11.2.4 | ≥ 12.2.0, < 12.2.1 | ≥ 12.4.0, < 12.4.3 | ≥ 12.6.0, < 12.6.5 | ≥ 12.8.0, < 12.8.2 | ≥ 12.10.0, < 12.10.2 | ≥ 13.2.0, < 13.2.1
- microsoft jdbc driver for sql server 10.2≥ 1.0.0, < 10.2.4
- microsoft jdbc driver for sql server 11.2≥ 1.0.0, < 11.2.4
- microsoft jdbc driver for sql server 12.10≥ 1.0.0, < 12.10.2
- microsoft jdbc driver for sql server 12.2≥ 1.0.0, < 12.2.1
Com.microsoft.sqlserver1 product
- mssql-jdbc≥ 8.3.0.jre11-preview, < 10.2.4.jre11 | ≥ 11.2.0.jre11, < 11.2.4.jre11 | ≥ 12.2.0.jre11, < 12.2.1.jre11 | ≥ 12.6.0.jre11, < 12.6.5.jre11 | ≥ 12.8.0.jre11, < 12.8.2.jre11 | ≥ 12.10.0.jre11, < 12.10.2.jre11 | ≥ 13.2.0.jre11, < 13.2.1.jre11
4 vendors · 63 products
