JDBC Driver for SQL Server Security Feature Bypass Vulnerability

How could an attacker exploit this vulnerability?
An attacker who controls or can impersonate the SQL Server could replay a legitimate attestation response while substituting attacker-controlled key material during a client connection. Successful exploitation could allow the attacker to obtain column encryption keys and access or modify protected database data.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation requires Always Encrypted with secure enclaves to use HGS attestation. The attacker must also control or impersonate the SQL Server connection and have access to a legitimate attestation response that can be replayed.

What could an attacker accomplish by exploiting this vulnerability?
Successful exploitation could allow an attacker to bypass secure-enclave attestation, obtain column encryption keys, decrypt protected database data, and create modified encrypted data that the client accepts as valid.

Security updates
13.6.0 — https://learn.microsoft.com/en-us/sql/connect/jdbc/release-notes-for-the-jdbc-driver?view=sql-server-ver17&viewFallbackFrom=sql-serve%E2%80%A6