CVE-2024-21366: Windows 10 1507 WDAC RCE Vulnerability

CVE-2024-21366 Overview

CVE-2024-21366 is a remote code execution vulnerability in the Microsoft Windows Data Access Components (WDAC) OLE DB provider for SQL Server. The flaw is classified as a heap-based buffer overflow [CWE-122] and affects supported versions of Windows 10, Windows 11, and Windows Server. An attacker can exploit the vulnerability by convincing a user to connect to a malicious SQL Server instance, triggering code execution in the context of the client process. The vulnerability carries a CVSS 3.1 score of 8.8 and an EPSS probability of 1.92% (83.5 percentile).

Critical Impact

Successful exploitation allows network-based remote code execution on a Windows client when a user initiates a SQL Server connection to an attacker-controlled endpoint, resulting in full compromise of confidentiality, integrity, and availability.

Affected Products

• Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (21H2, 22H2, 23H2)
• Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

• 2024-02-13 - CVE-2024-21366 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-21366

Vulnerability Analysis

The vulnerability resides in the WDAC OLE DB provider for SQL Server, the client-side component Windows applications use to communicate with SQL Server instances. The component mishandles data returned from a SQL Server endpoint, producing a heap-based buffer overflow [CWE-122] in client memory. An attacker who controls a malicious SQL Server can return crafted protocol responses that overflow an internal heap buffer during connection processing. The overflow corrupts adjacent heap structures and can be steered toward arbitrary code execution within the connecting client process.

Exploitation requires user interaction. A victim must be persuaded to connect to the attacker-controlled SQL Server using a tool or application that loads the affected OLE DB provider. The attack vector is network-based and does not require prior authentication on the target client.

Root Cause

The root cause is improper validation of length or size fields in server-supplied data parsed by the OLE DB provider. The provider allocates a fixed-size heap buffer and copies attacker-controlled data into it without enforcing the destination bounds. This results in a classic heap-based buffer overflow during connection or query response handling.

Attack Vector

An attacker hosts a malicious SQL Server instance and entices a user to initiate an outbound connection. Common delivery methods include phishing links that invoke ODBC or OLE DB connection strings, malicious Office documents that trigger external data connections, or compromised internal services that redirect clients. Once the client connects, the malicious server replies with a crafted TDS (Tabular Data Stream) response that overflows the heap buffer in the OLE DB provider and executes code with the privileges of the connecting user.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in prose based on the Microsoft advisory; see the Microsoft CVE-2024-21366 Advisory for vendor details.

Detection Methods for CVE-2024-21366

Indicators of Compromise

• Outbound TCP connections from workstations to untrusted external hosts on TDS ports (default 1433 and dynamic SQL Browser port 1434/UDP).
• Unexpected child processes spawned by applications hosting the OLE DB provider such as excel.exe, powershell.exe, or custom line-of-business clients.
• Crash dumps or Windows Error Reporting events referencing msoledbsql.dll or sqloledb.dll with heap corruption signatures.

Detection Strategies

• Hunt for processes loading msoledbsql.dll or sqloledb.dll that subsequently initiate outbound connections to non-corporate IP ranges.
• Correlate Office or scripting host processes opening SQL connections immediately after document open or email link click events.
• Alert on heap corruption exceptions (0xC0000374, 0xC0000409) in processes that consume the OLE DB provider.

Monitoring Recommendations

• Enable Sysmon Event ID 3 (network connect) and Event ID 7 (image load) to track OLE DB provider usage across endpoints.
• Forward Windows Defender Exploit Guard and WER telemetry to a central SIEM for heap-overflow signal correlation.
• Apply egress filtering at perimeter firewalls to block SQL Server protocol traffic to unapproved destinations.

How to Mitigate CVE-2024-21366

Immediate Actions Required

• Apply the February 2024 Microsoft security updates referenced in the Microsoft CVE-2024-21366 Advisory to all affected Windows client and server systems.
• Inventory endpoints with the WDAC OLE DB provider installed and prioritize patching for users who routinely connect to external SQL Server instances.
• Block outbound TDS traffic (TCP 1433, UDP 1434) at the perimeter except to approved internal SQL Server hosts.

Patch Information

Microsoft addressed CVE-2024-21366 in the February 13, 2024 Patch Tuesday release. The fix is delivered through cumulative Windows updates for each supported Windows 10, Windows 11, and Windows Server build listed in the advisory. Administrators should validate that the corresponding KB article for each Windows version is installed and that systems have rebooted to complete patch application.

Workarounds

• Restrict the ability of users to initiate outbound SQL Server connections to untrusted networks using host firewall rules and Windows Defender Firewall outbound policies.
• Disable or remove the legacy WDAC OLE DB provider on systems that do not require SQL Server connectivity.
• Enforce attack surface reduction rules that block Office applications from creating child processes and from making outbound network connections.

# Block outbound SQL Server TDS traffic from a Windows endpoint
New-NetFirewallRule -DisplayName "Block Outbound SQL TDS" `
  -Direction Outbound -Protocol TCP -RemotePort 1433 `
  -Action Block -Profile Any

New-NetFirewallRule -DisplayName "Block Outbound SQL Browser" `
  -Direction Outbound -Protocol UDP -RemotePort 1434 `
  -Action Block -Profile Any