CVE-2024-21375: Windows 10 1507 WDAC RCE Vulnerability

CVE-2024-21375 Overview

CVE-2024-21375 is a remote code execution vulnerability in the Microsoft Windows Data Access Components (WDAC) OLE DB provider for SQL Server. The flaw is tracked as a use-after-free condition [CWE-416] and affects supported releases of Windows 10, Windows 11, and Windows Server. An attacker who tricks an authenticated user into connecting to a malicious SQL Server can execute arbitrary code in the context of that user. The vulnerability carries a CVSS 3.1 score of 8.8 and an EPSS probability of 1.92% (83.7th percentile), reflecting elevated likelihood of exploitation activity.

Critical Impact
Successful exploitation gives an attacker code execution on the victim host with the privileges of the user initiating the SQL connection, enabling lateral movement and data compromise.

Affected Products

Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and Server 2022 23H2

Discovery Timeline

2024-02-13 - CVE-2024-21375 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-21375

Vulnerability Analysis

The vulnerability resides in the WDAC OLE DB provider for SQL Server, the client-side component Windows applications use to issue queries against SQL Server endpoints. The provider mishandles object lifetime during processing of crafted server responses, producing a use-after-free condition [CWE-416]. An attacker who controls a SQL Server—or who can intercept and respond to a victim's connection—returns a malicious response that triggers reuse of a freed object. Reuse allows the attacker to redirect execution flow into attacker-controlled memory, achieving remote code execution under the calling process.

The attack vector is network-based and requires user interaction: a user must initiate a connection from a vulnerable client to the attacker-controlled SQL Server instance. No prior authentication on the target is required. Resulting code execution inherits the privileges of the connecting account, which often includes access to sensitive data sources and credentials.

Root Cause

The root cause is improper memory management in the OLE DB provider, where a pointer to a freed object is dereferenced during response parsing. The provider fails to invalidate references after the object is released, leaving a dangling pointer reachable by attacker-controlled state.

Attack Vector

Exploitation typically follows a social engineering step in which a victim is induced to connect to a hostile SQL Server through a crafted link, ODBC data source, or compromised application configuration. Once the client connects, the malicious server returns specifically crafted response packets that drive the use-after-free condition and pivot execution to attacker-supplied shellcode.

No public proof-of-concept exploit is currently available in Exploit-DB, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Update guidance for CVE-2024-21375 for vendor technical details.

Detection Methods for CVE-2024-21375

Indicators of Compromise

Outbound TCP connections from end-user workstations to untrusted SQL Server endpoints on port 1433 or other configured listener ports.
Unexpected child processes spawned by applications that load msoledbsql.dll or sqloledb.dll, particularly shell or scripting interpreters.
Crash dumps or Windows Error Reporting entries referencing the OLE DB provider modules following SQL connection attempts.

Detection Strategies

Monitor process telemetry for Office, browser, or line-of-business applications loading the OLE DB provider and subsequently invoking cmd.exe, powershell.exe, or rundll32.exe.
Correlate DNS resolutions and TCP flows to SQL Server hosts outside known internal address space and flag user-initiated connections to those destinations.
Hunt for anomalous module loads of msoledbsql.dll by processes that do not normally consume database connectivity.

Monitoring Recommendations

Enable Sysmon or equivalent EDR module-load and process-create logging on workstations that handle database connectivity.
Forward Windows Application and System event logs to a centralized analytics platform and alert on faulting modules tied to the OLE DB provider.
Track egress traffic to TCP/1433 and TCP/1434 from user subnets that should not require direct SQL Server access.

How to Mitigate CVE-2024-21375

Immediate Actions Required

Apply the February 2024 Microsoft security updates referenced in the MSRC advisory for CVE-2024-21375 to all affected Windows client and server builds.
Inventory systems with the WDAC OLE DB provider installed and prioritize patching for endpoints used by database administrators and developers.
Restrict outbound SQL Server connectivity from end-user segments to known, sanctioned database hosts via firewall policy.

Patch Information

Microsoft released cumulative updates addressing CVE-2024-21375 on February 13, 2024. The fixes correct the object lifetime handling in the OLE DB provider for SQL Server. Refer to the Microsoft Security Update guide for the specific KB articles tied to each Windows build.

Workarounds

Block outbound TCP/1433 and TCP/1434 from user workstations at the perimeter and internal firewalls where direct SQL access is not required.
Disable or remove the OLE DB provider on systems that do not require SQL Server client connectivity.
Enforce application allowlisting to prevent execution of unauthorized binaries spawned by processes that use the OLE DB provider.

bash

# Configuration example: block outbound SQL Server traffic from a workstation
New-NetFirewallRule -DisplayName "Block Outbound SQL Server" `
  -Direction Outbound `
  -Protocol TCP `
  -RemotePort 1433,1434 `
  -Action Block `
  -Profile Any