CVE-2025-59250
JDBC Driver for SQL Server Spoofing Vulnerability
Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
JDBC Driver for SQL Server Spoofing Vulnerability
Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.
- Record
CVE-2025-59250- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2025-34375
Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.
- Record
EUVD-2025-34375- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m494-w24q-6f7w
JDBC Driver for SQL Server has improper input validation issue
Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.
- Record
GHSA-m494-w24q-6f7w- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.
- Record
CVE-2025-59250- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.
- Record
CVE-2025-59250- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-m494-w24q-6f7w
JDBC Driver for SQL Server has improper input validation issue
Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.
- Record
GHSA-m494-w24q-6f7w- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2025-59250 No score
CVE-2025-59250 in com.microsoft.sqlserver:mssql-jdbc - Patched by Root
Root has patched CVE-2025-59250 in the com.microsoft.sqlserver:mssql-jdbc package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2025-59250- Updated
- 2026-11-05
Affected products
- microsoft jdbc driver for sql server
- microsoft jdbc driver for sql server 10.2
- microsoft jdbc driver for sql server 11.2
- microsoft jdbc driver for sql server 12.10
- microsoft jdbc driver for sql server 12.2
- microsoft jdbc driver for sql server 12.4
- microsoft jdbc driver for sql server 12.6
- microsoft jdbc driver for sql server 12.8
- microsoft jdbc driver for sql server 13.2
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.microsoft.sqlserver:mssql-jdbcMaven |
11.2.0.jre11 up to 11.2.4.jre11 | 11.2.4.jre11 |
com.microsoft.sqlserver:mssql-jdbcMaven |
12.2.0.jre11 up to 12.2.1.jre11 | 12.2.1.jre11 |
com.microsoft.sqlserver:mssql-jdbcMaven |
12.6.0.jre11 up to 12.6.5.jre11 | 12.6.5.jre11 |
com.microsoft.sqlserver:mssql-jdbcMaven |
12.8.0.jre11 up to 12.8.2.jre11 | 12.8.2.jre11 |
com.microsoft.sqlserver:mssql-jdbcMaven |
12.10.0.jre11 up to 12.10.2.jre11 | 12.10.2.jre11 |
com.microsoft.sqlserver:mssql-jdbcMaven |
13.2.0.jre11 up to 13.2.1.jre11 | 13.2.1.jre11 |
com.microsoft.sqlserver:mssql-jdbcMaven |
8.3.0.jre11-preview up to 10.2.4.jre11 | 10.2.4.jre11 |
com.microsoft.sqlserver:mssql-jdbcMaven |
8.3.0.jre11-preview up to 10.2.4.jre11, plus listed versions 10.1.0.jre11-preview10.1.0.jre17-preview10.1.0.jre8-preview10.2.0-SNAPSHOT.jre11-preview10.2.0-SNAPSHOT.jre17-preview Show 45 moreShow less10.2.0-SNAPSHOT.jre8-preview10.2.0.jre1110.2.0.jre1710.2.0.jre810.2.1.jre1110.2.1.jre1710.2.1.jre810.2.2.jre1110.2.2.jre11-preview10.2.2.jre1710.2.2.jre17-preview10.2.2.jre810.2.2.jre8-preview10.2.3.jre1110.2.3.jre1710.2.3.jre810.2.4.jre88.3.0.jre14-preview8.3.1.jre11-preview8.3.1.jre14-preview8.3.1.jre8-preview8.4.0.jre118.4.0.jre148.4.0.jre88.4.1.jre118.4.1.jre148.4.1.jre89.1.0.jre11-preview9.1.0.jre15-preview9.1.0.jre8-preview9.1.1.jre11-preview9.1.1.jre15-preview9.1.1.jre8-preview9.2.0.jre119.2.0.jre159.2.0.jre89.2.1.jre119.2.1.jre159.2.1.jre89.3.0.jre11-preview9.3.0.jre15-preview9.3.0.jre8-preview9.3.1.jre11-preview9.3.1.jre15-preview9.3.1.jre8-preview |
10.2.4.jre11 |
com.microsoft.sqlserver:mssql-jdbcMaven |
11.2.0.jre11 up to 11.2.4.jre11, plus listed versions 11.2.0.jre1711.2.0.jre1811.2.1.jre1111.2.1.jre1711.2.1.jre18 Show 10 moreShow less11.2.1.jre811.2.2.jre1111.2.2.jre1711.2.2.jre1811.2.2.jre811.2.3.jre1111.2.3.jre1711.2.3.jre1811.2.3.jre811.2.4.jre8 |
11.2.4.jre11 |
com.microsoft.sqlserver:mssql-jdbcMaven |
12.2.0.jre11 up to 12.2.1.jre11, plus listed versions 12.2.1.jre8 |
12.2.1.jre11 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
com.microsoft.sqlserver:mssql-jdbcMaven |
12.6.0.jre11 up to 12.6.5.jre11, plus listed versions 12.6.1.jre1112.6.1.jre812.6.2.jre1112.6.2.jre812.6.3.jre11 Show 4 moreShow less12.6.3.jre812.6.4.jre1112.6.4.jre812.6.5.jre8 |
12.6.5.jre11 |
com.microsoft.sqlserver:mssql-jdbcMaven |
12.8.0.jre11 up to 12.8.2.jre11, plus listed versions 12.8.1.jre1112.8.1.jre812.8.2.jre8 |
12.8.2.jre11 |
com.microsoft.sqlserver:mssql-jdbcMaven |
12.10.0.jre11 up to 12.10.2.jre11, plus listed versions 12.10.1.jre1112.10.1.jre812.10.2.jre8 |
12.10.2.jre11 |
com.microsoft.sqlserver:mssql-jdbcMaven |
13.2.0.jre11 up to 13.2.1.jre11, plus listed versions 13.2.1.jre8 |
13.2.1.jre11 |
com.microsoft.sqlserver:mssql-jdbcRoot:Maven |
before 9.4.1-aikido.1 | 9.4.1-aikido.112.10.1-aikido.1 |
io.root.com.microsoft.sqlserver:mssql-jdbcRoot:Maven |
before 9.4.1-root.io.1 | 9.4.1-root.io.112.10.1-root.io.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-59250 is a high vulnerability (CVSS 8.1) in Microsoft Jdbc Driver For Sql Server, published October 14, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. Fixed in com.microsoft.sqlserver:mssql-jdbc 11.2.4.jre11.
References
msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59250
nvd.nist.gov/vuln/detail/CVE-2025-59250
github.com/microsoft/mssql-jdbc/pull/2798
Show 7 moreShow less
learn.microsoft.com/en-us/sql/connect/jdbc/microsoft-jdbc-driver-for-sql-server-support-matrix
Left out here: 15 versions. The JSON record has them.