According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution? The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. There are GDR and/or CU (Cumulative Update) updates offered for my version of SQL Server. How do I know which update to use? First, determine your SQL Server version number. For more information on determining your SQL Server version number, see Microsoft Knowledge Base Article 321185 - How to determine the version, edition, and update level of SQL Server and its components. Second, in the table below, locate your version number or the version range that your version number falls within. The corresponding update is the one you need to install. Note If your SQL Server version number is not represented in the table below, your SQL Server version is no longer supported. Please upgrade to the latest Service Pack or SQL Server product in order to apply this and future security updates. Update number Title Apply if current product version is… This security update also includes servicing releases up through… 5021522 Security update for SQL Server 2022 RTM+GDR (Feb 2023) 16.0.1000.6 N/A 5021124 Security update for SQL Server 2019 CU18+GDR (Feb 2023) 15.0.4003.23 - 15.0.4261.1 KB 5017593 – SQL2019 RTM CU18 5021125 Security update for SQL Server 2019 RTM+GDR (Feb 2023) 15.0.2000.5 - 15.0.2095.3 KB 5014356 - Previous SQL2019 RTM GDR 5021126 Security update for SQL Server 2017 CU31+GDR (Feb 2023) 14.0.3006.16 - 14.0.3456.2 KB 5016884 – SQL2017 RTM CU31 5021127 Security update for SQL Server 2017 RTM+GDR (Feb 2023) 14.0.1000.169 - 14.0.2042.3 KB 5014354 - Previous SQL2017 RTM GDR 5021128 Security update for SQL Server 2016 SP3 Azure
Nicolas Joly of MSRC