CVE-2024-28911: OLE DB Driver for SQL Server RCE Flaw

CVE-2024-28911 Overview

CVE-2024-28911 is a remote code execution vulnerability in the Microsoft OLE DB Driver for SQL Server. The flaw stems from a heap-based buffer overflow [CWE-122] in how the driver processes server responses. An attacker who controls or impersonates a malicious SQL Server can execute arbitrary code on a client system that connects to it. Exploitation requires user interaction, typically through tricking a victim into initiating a connection to an attacker-controlled server. The vulnerability affects the standalone OLE DB Driver as well as installations bundled with SQL Server 2019 and SQL Server 2022.

Critical Impact
Successful exploitation grants attackers code execution in the context of the SQL client process, enabling lateral movement, credential theft, and database compromise.

Affected Products

Microsoft OLE DB Driver for SQL Server (MSOLEDBSQL)
Microsoft SQL Server 2019 (x64)
Microsoft SQL Server 2022 (x64)

Discovery Timeline

2024-04-09 - CVE-2024-28911 published to the National Vulnerability Database
2024-04-09 - Microsoft released security update guidance for CVE-2024-28911
2025-01-07 - Last updated in NVD database

Technical Details for CVE-2024-28911

Vulnerability Analysis

The vulnerability resides in the client-side OLE DB Driver for SQL Server, the data access component used by applications to communicate with SQL Server instances using the Tabular Data Stream (TDS) protocol. A heap-based buffer overflow occurs when the driver parses crafted response data from a SQL Server. The driver writes attacker-controlled bytes past the bounds of a heap allocation, corrupting adjacent memory structures.

Because the flaw is in the client driver, the attack flow reverses the typical client-server trust model. The malicious party operates the server, and the victim runs the vulnerable client component. Any application that loads msoledbsql.dll and connects to an untrusted endpoint is exposed.

Root Cause

The root cause is insufficient validation of length or size fields within data returned by a SQL Server during connection negotiation or result processing. The driver allocates a fixed or undersized heap buffer and copies response data without enforcing bounds, satisfying the conditions for [CWE-122] heap-based buffer overflow. Attackers can leverage the overwrite to corrupt heap metadata or function pointers, achieving control of the instruction pointer.

Attack Vector

The attack vector is network-based and requires user interaction. A typical exploitation chain involves an attacker hosting a rogue SQL Server, then luring a target into connecting by phishing a connection string, abusing linked-server queries, or compromising a configuration file. When the victim application initiates the connection, the malicious server returns the crafted TDS packets that trigger the overflow. The EPSS score of 2.213% places this CVE in the 80th percentile for likelihood of exploitation activity.

No public proof-of-concept exploit code is available for CVE-2024-28911. Technical details are described in prose; refer to the Microsoft Security Update CVE-2024-28911 advisory for vendor specifics.

Detection Methods for CVE-2024-28911

Indicators of Compromise

Outbound TDS connections (typically TCP/1433 or dynamic ports) from workstations or application servers to untrusted external IP addresses.
Unexpected child processes spawned by applications that load msoledbsql.dll, such as sqlservr.exe clients, SSMS, or custom .NET/ODBC applications.
Crash events or Windows Error Reporting entries citing access violations inside msoledbsql.dll heap routines.

Detection Strategies

Inventory hosts that have the OLE DB Driver for SQL Server installed and cross-reference installed versions against the patched builds listed in Microsoft's advisory.
Hunt for process trees where database client processes spawn shells (cmd.exe, powershell.exe) or LOLBins, indicating post-exploitation activity.
Monitor for connection strings or sp_addlinkedserver invocations referencing non-corporate SQL Server endpoints.

Monitoring Recommendations

Enable EDR memory-protection telemetry on application servers and developer workstations that use OLE DB to access SQL Server.
Forward Windows Application and Security event logs to a centralized SIEM and alert on faulting module msoledbsql.dll.
Restrict outbound TDS traffic at the network egress layer and log denied connections for investigation.

How to Mitigate CVE-2024-28911

Immediate Actions Required

Apply the Microsoft security updates referenced in the Microsoft Security Update CVE-2024-28911 advisory to all affected systems.
Enumerate every workstation, application server, and SQL Server host with msoledbsql.dll present, including redistributable installations packaged with third-party software.
Block outbound connections to untrusted SQL Server endpoints at perimeter and host firewalls until patching is verified.

Patch Information

Microsoft published patched builds of the standalone Microsoft OLE DB Driver for SQL Server (MSOLEDBSQL) and corresponding updates for SQL Server 2019 and SQL Server 2022. Administrators should obtain the latest installers from the Microsoft Security Update CVE-2024-28911 advisory and confirm the updated file version of msoledbsql.dll on each endpoint after deployment.

Workarounds

Restrict which SQL Server endpoints client applications are permitted to reach using firewall rules or application allowlists.
Educate users and developers to avoid opening or importing connection strings, .udl files, or linked-server definitions from untrusted sources.
Where feasible, migrate applications to the Microsoft ODBC Driver or Microsoft.Data.SqlClient with current patches as a defense-in-depth measure while validating OLE DB updates.

bash

# Verify the installed OLE DB Driver version on Windows hosts
powershell -Command "Get-Item 'C:\Windows\System32\msoledbsql.dll' | Select-Object -ExpandProperty VersionInfo"

# Enumerate installed MSOLEDBSQL package via registry
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "Microsoft OLE DB Driver"