CVE-2024-26210: Windows 10 1507 WDAC RCE Vulnerability

CVE-2024-26210 Overview

CVE-2024-26210 is a remote code execution vulnerability in the Microsoft Windows Data Access Components (WDAC) OLE DB provider for SQL Server. The flaw is rooted in a heap-based buffer overflow [CWE-122] within the OLE DB driver code path used to communicate with SQL Server instances. An attacker who convinces an authenticated user to connect a vulnerable client to an attacker-controlled SQL Server can trigger memory corruption and execute arbitrary code in the user context. The vulnerability affects a broad set of Windows client and server SKUs, including Windows 10, Windows 11, and Windows Server 2008 through Windows Server 2022 23H2.

Critical Impact

Successful exploitation yields arbitrary code execution on the connecting client, enabling full compromise of confidentiality, integrity, and availability under the victim user's privileges.

Affected Products

• Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2) and Windows 11 (21H2, 22H2, 23H2)
• Microsoft Windows Server 2008 SP2, 2008 R2 SP1, 2012, and 2012 R2
• Microsoft Windows Server 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

• 2024-04-09 - CVE-2024-26210 published to NVD as part of Microsoft's Patch Tuesday release
• 2024-12-06 - Last updated in NVD database

Technical Details for CVE-2024-26210

Vulnerability Analysis

The vulnerability resides in the Microsoft OLE DB provider for SQL Server, a component of Windows Data Access Components used by applications to query SQL Server databases. The driver mishandles data received from a SQL Server during connection or query response parsing, leading to a heap-based buffer overflow on the client side. Because the attack vector is network-based with low complexity and requires no privileges, any user-mode process that loads the OLE DB provider and connects outbound to a malicious server is at risk. User interaction is required, typically through opening a document, launching an application, or clicking a connection link that initiates the outbound SQL Server connection.

Root Cause

The root cause is a heap-based buffer overflow [CWE-122] in the WDAC OLE DB provider for SQL Server. The provider allocates a fixed-size heap buffer but copies attacker-controlled response data without enforcing destination bounds. Corruption of adjacent heap metadata and function pointers within the loaded provider DLL allows an attacker to redirect execution flow.

Attack Vector

Exploitation requires an attacker to host a malicious SQL Server endpoint and lure a Windows user into connecting to it from an application that uses the OLE DB provider, such as Excel, SQL Server Management Studio, custom .NET or COM applications, or BI tools. Once the client establishes the connection, the rogue server returns crafted Tabular Data Stream (TDS) responses that overflow the client-side heap buffer. Code executes in the security context of the user running the client application. With an EPSS score of 2.98%, the vulnerability sits in the 86th percentile for exploitation likelihood, reflecting meaningful interest among threat actors.

No public proof-of-concept code has been released. The vulnerability is described in prose only; see the Microsoft Security Update Guide for CVE-2024-26210 for vendor technical details.

Detection Methods for CVE-2024-26210

Indicators of Compromise

• Outbound TCP connections to untrusted hosts on port 1433 or other SQL Server ports originating from Office applications, sqlservr.exe clients, or custom business applications
• Unexpected child processes spawned by excel.exe, ssms.exe, or applications that load msoledbsql.dll or sqloledb.dll
• Crash dumps in the Windows Error Reporting queue referencing the OLE DB SQL Server provider modules

Detection Strategies

• Hunt for processes loading msoledbsql.dll or sqloledb.dll that subsequently initiate outbound connections to non-corporate IP ranges
• Correlate TDS protocol traffic to external destinations with the host process responsible for the connection
• Alert on memory access violations or heap corruption exceptions in processes hosting the OLE DB SQL Server provider

Monitoring Recommendations

• Restrict and log outbound SQL Server traffic (TCP/1433, TCP/1434, and named-instance ports) at the perimeter and host firewalls
• Enable Microsoft Defender for Endpoint or equivalent EDR rules that flag office productivity tools establishing database connections to untrusted hosts
• Monitor Sysmon Event ID 7 (image load) for the OLE DB provider DLLs paired with Event ID 3 (network connect) to detect anomalous client-to-server flows

How to Mitigate CVE-2024-26210

Immediate Actions Required

• Apply the April 2024 Microsoft security updates referenced in the Microsoft Security Update Guide for CVE-2024-26210 to all affected Windows client and server systems
• Inventory endpoints with the OLE DB provider for SQL Server installed, including developer workstations, BI users, and DBA tooling hosts
• Block outbound connections to external SQL Server endpoints at the network egress layer unless explicitly required for business use

Patch Information

Microsoft addressed CVE-2024-26210 in its April 2024 Patch Tuesday release. Updates are available through Windows Update, WSUS, and the Microsoft Update Catalog for every supported Windows 10, Windows 11, and Windows Server release listed in the advisory. Administrators should validate that the cumulative update for each OS build has been installed and that the OLE DB provider files have been refreshed.

Workarounds

• If immediate patching is not possible, restrict outbound TCP/1433 and dynamic SQL Server ports to known internal database servers using host-based and perimeter firewalls
• Educate users to avoid opening database connection files (.udl, .odc, .dsn) or Office documents from untrusted sources that may trigger outbound SQL Server connections
• Where feasible, remove or disable the legacy OLE DB provider on systems that do not require SQL Server connectivity

# Configuration example: block outbound SQL Server traffic to non-corporate networks
New-NetFirewallRule -DisplayName "Block Outbound SQL Server 1433" `
  -Direction Outbound `
  -Protocol TCP `
  -RemotePort 1433 `
  -RemoteAddress Internet `
  -Action Block