CVE-2024-28914: OLE DB Driver for SQL Server RCE Flaw

CVE-2024-28914 Overview

CVE-2024-28914 is a remote code execution vulnerability in the Microsoft OLE DB Driver for SQL Server. The flaw affects the OLE DB Driver shipped with Microsoft SQL Server 2019 and SQL Server 2022 on x64 platforms. An attacker who controls a malicious SQL Server instance can trigger memory corruption in a connecting client. The weakness is categorized as a heap-based buffer overflow [CWE-122]. Microsoft published the advisory on April 9, 2024, and exploitation requires user interaction to initiate the connection to the attacker-controlled server.

Critical Impact
Successful exploitation allows an attacker to execute arbitrary code in the context of the connecting client application, with full impact on confidentiality, integrity, and availability.

Affected Products

Microsoft OLE DB Driver for SQL Server
Microsoft SQL Server 2019 (x64)
Microsoft SQL Server 2022 (x64)

Discovery Timeline

2024-04-09 - CVE-2024-28914 published to NVD and disclosed by Microsoft
2024-04-09 - Microsoft releases security update via MSRC advisory
2025-01-07 - Last updated in NVD database

Technical Details for CVE-2024-28914

Vulnerability Analysis

The vulnerability resides in how the OLE DB Driver for SQL Server parses data returned by a SQL Server endpoint. A malformed server response can corrupt heap memory inside the client process loading the driver. The driver is widely embedded in applications, scripts, and middleware that connect to SQL Server through the MSOLEDBSQL provider. An attacker who hosts a rogue SQL Server can craft Tabular Data Stream (TDS) responses that trigger the overflow during result processing. Because the flaw executes in the client, applications running with elevated privileges expand the blast radius. Microsoft classifies the flaw as remote code execution requiring user interaction.

Root Cause

The root cause is a heap-based buffer overflow [CWE-122] in the OLE DB Driver's response parsing logic. The driver fails to correctly validate length or boundary fields supplied by the remote server before copying data into a fixed-size heap buffer. This permits an attacker-controlled length to overwrite adjacent heap structures, including function pointers and allocator metadata.

Attack Vector

Exploitation requires a victim application or user to initiate an outbound connection to an attacker-controlled SQL Server endpoint. Common attack scenarios include phishing links that launch ODBC/OLE DB clients, malicious connection strings injected into vulnerable applications, and DNS or routing manipulation that redirects legitimate connections to a rogue server. Network access is required (AV:N), no privileges are needed on the target (PR:N), and user interaction (UI:R) is necessary to trigger the connection.

No public proof-of-concept exploit is available. Refer to the Microsoft CVE-2024-28914 Advisory for technical details.

Detection Methods for CVE-2024-28914

Indicators of Compromise

Outbound TDS connections (TCP/1433 or non-standard ports) from workstations or servers to untrusted external SQL Server hosts.
Crash dumps or Windows Error Reporting events involving msoledbsql.dll or sqlncli.dll in client processes.
Unexpected child processes spawned by applications that use the OLE DB provider (Excel, Power BI, SSMS, custom .NET or Python tools).

Detection Strategies

Inventory all hosts loading msoledbsql.dll and correlate with installed driver versions to identify unpatched systems.
Hunt for processes initiating SQL Server connections to destinations outside approved database subnets.
Monitor for memory integrity violations and exception events in processes consuming the OLE DB provider.

Monitoring Recommendations

Enable PowerShell and process command-line logging to capture connection strings referencing Provider=MSOLEDBSQL.
Forward driver-related crash telemetry and EDR memory events to a centralized SIEM for correlation.
Alert on TDS protocol traffic egressing to the public internet, which is uncommon in most enterprises.

How to Mitigate CVE-2024-28914

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory to all systems running the OLE DB Driver for SQL Server.
Update SQL Server 2019 and SQL Server 2022 installations, which bundle the affected driver.
Audit application servers, developer workstations, and BI tools for embedded versions of msoledbsql.dll and patch independently of SQL Server.

Patch Information

Microsoft has released fixed versions of the OLE DB Driver for SQL Server. Administrators should consult the Microsoft CVE-2024-28914 Advisory for the specific driver build numbers and download locations corresponding to each supported platform.

Workarounds

Restrict outbound TCP/1433 and TDS traffic to known, internal SQL Server endpoints using host or perimeter firewalls.
Enforce the use of trusted connection strings and prevent applications from accepting dynamic SQL Server hostnames from untrusted input.
Remove the OLE DB Driver from systems that do not require database connectivity to reduce attack surface.

bash

# Example: block outbound SQL Server traffic to non-approved destinations on Windows
New-NetFirewallRule -DisplayName "Block-Outbound-TDS" `
  -Direction Outbound -Protocol TCP -RemotePort 1433 `
  -RemoteAddress Any -Action Block