CVE-2024-28912: OLE DB Driver for SQL Server RCE Flaw

CVE-2024-28912 Overview

CVE-2024-28912 is a remote code execution vulnerability in the Microsoft OLE DB Driver for SQL Server. The flaw is classified as a heap-based buffer overflow [CWE-122] and affects the OLE DB Driver bundled with SQL Server 2019 and SQL Server 2022. An attacker who convinces an authenticated user to connect a vulnerable client to a malicious SQL Server instance can execute arbitrary code in the context of the client process. Microsoft published the advisory on April 9, 2024 as part of its monthly security update cycle.

Critical Impact
Successful exploitation grants attackers remote code execution on the client machine, leading to full confidentiality, integrity, and availability compromise of the affected host.

Affected Products

Microsoft OLE DB Driver for SQL Server
Microsoft SQL Server 2019 (x64)
Microsoft SQL Server 2022 (x64)

Discovery Timeline

2024-04-09 - Microsoft releases security patch and publishes advisory for CVE-2024-28912
2024-04-09 - CVE-2024-28912 published to the National Vulnerability Database
2025-01-07 - Last updated in NVD database

Technical Details for CVE-2024-28912

Vulnerability Analysis

The vulnerability resides in the Microsoft OLE DB Driver for SQL Server, a client-side data access component used by applications to communicate with SQL Server instances using the Tabular Data Stream (TDS) protocol. The driver mishandles a length or size field while parsing a server response, producing a heap-based buffer overflow [CWE-122]. The attack requires network connectivity to a malicious server and user interaction, since the victim must initiate or be tricked into initiating a connection. Once exploited, the attacker controls execution within the process loading the driver, typically a SQL client, application server, ETL job, or administrative tool. The EPSS score of 2.268% places this issue in the 80th percentile for likelihood of exploitation activity.

Root Cause

The root cause is improper validation of attacker-controlled fields in TDS protocol messages returned by the server. When the driver allocates a heap buffer based on one size value and copies data using a different size, the resulting overflow corrupts adjacent heap structures. This corruption is reachable from any client application that uses the OLE DB provider to connect outward.

Attack Vector

An attacker hosts a malicious SQL Server endpoint and lures a victim into connecting to it through phishing, a forged connection string, a compromised DNS entry, or a tampered ODBC data source. When the client opens a session, the rogue server returns a crafted response that triggers the heap overflow inside the OLE DB driver. Because the attack runs in the client process, exploitation inherits the privileges of that process, which is often a service or administrative account on backend systems. See the Microsoft Security Update Advisory for the official technical description.

Detection Methods for CVE-2024-28912

Indicators of Compromise

Outbound TDS connections (TCP/1433 or custom ports) from application servers to untrusted or newly observed external IP addresses.
Unexpected child processes spawned from applications that load msoledbsql.dll or oledb32.dll.
Crash dumps or Windows Error Reporting events showing access violations inside msoledbsql.dll.
New or modified ODBC data source registry entries under HKLM\SOFTWARE\ODBC\ODBC.INI pointing to unfamiliar hosts.

Detection Strategies

Hunt for processes loading the OLE DB driver and subsequently executing cmd.exe, powershell.exe, or other living-off-the-land binaries.
Inspect TDS traffic for malformed length fields or oversized token streams using network protocol analyzers.
Correlate phishing email events with subsequent outbound SQL connections originating from user workstations.

Monitoring Recommendations

Restrict and log all outbound SQL Server connections at the firewall, allowing only approved database endpoints.
Enable PowerShell, command line, and module load auditing on hosts that run SQL client tooling.
Forward driver-related crash telemetry and EDR events to a centralized SIEM for correlation across endpoints.

How to Mitigate CVE-2024-28912

Immediate Actions Required

Apply the April 2024 Microsoft security update for the Microsoft OLE DB Driver for SQL Server on all client and server hosts.
Update SQL Server 2019 and SQL Server 2022 installations to the patched cumulative updates that ship the fixed driver.
Inventory third-party applications that bundle the OLE DB driver and update those distributions to versions containing the patched binary.
Block outbound TCP/1433 and custom SQL ports from workstations and DMZ systems that do not require direct database connectivity.

Patch Information

Microsoft addressed CVE-2024-28912 in the April 9, 2024 security update. Patched builds of the Microsoft OLE DB Driver for SQL Server (MSOLEDBSQL) and the corresponding SQL Server 2019 and SQL Server 2022 cumulative updates resolve the heap overflow. Refer to the Microsoft Security Update Advisory for the specific build numbers and download links.

Workarounds

Where patching is delayed, restrict client systems to connect only to known internal SQL Server endpoints using firewall egress rules.
Disable or remove unused ODBC and OLE DB data sources that could be leveraged to initiate connections to attacker-controlled servers.
Apply application allow-listing to prevent execution of unsigned binaries spawned from processes that host the OLE DB driver.

bash

# Configuration example: Windows Firewall rule restricting outbound SQL traffic
New-NetFirewallRule -DisplayName "Block Outbound SQL to Untrusted Hosts" `
  -Direction Outbound `
  -Protocol TCP `
  -RemotePort 1433 `
  -RemoteAddress Any `
  -Action Block `
  -Profile Any