CVE-2024-28926: Microsoft OLE DB Driver for SQL RCE

CVE-2024-28926 Overview

CVE-2024-28926 is a remote code execution vulnerability in the Microsoft OLE DB Driver for SQL Server. The flaw is classified as a heap-based buffer overflow [CWE-122] and affects the client-side driver used by applications to connect to SQL Server instances. Exploitation requires a victim to connect to an attacker-controlled SQL Server, which then returns a malicious response that triggers memory corruption in the client driver. Successful exploitation leads to code execution in the context of the connecting application. Microsoft published the advisory on April 9, 2024, with the entry last modified on January 15, 2025.

Critical Impact
An attacker controlling a malicious SQL Server can execute arbitrary code on any client that connects through a vulnerable OLE DB Driver, resulting in full compromise of confidentiality, integrity, and availability.

Affected Products

Microsoft OLE DB Driver for SQL Server
Microsoft SQL Server 2019 (x64)
Microsoft SQL Server 2022 (x64)

Discovery Timeline

2024-04-09 - CVE-2024-28926 published to NVD and Microsoft releases security update
2025-01-15 - Last updated in NVD database

Technical Details for CVE-2024-28926

Vulnerability Analysis

The vulnerability resides in the Microsoft OLE DB Driver for SQL Server, the native client component used by Windows applications to communicate with SQL Server over the Tabular Data Stream (TDS) protocol. The driver mishandles data returned by a SQL Server during a client session, leading to a heap-based buffer overflow [CWE-122].

Because the flaw is triggered through driver responses rather than queries, the attack inverts the usual SQL Server trust model. The vulnerable code path is reached when a client application establishes a connection and processes server-supplied data structures. Exploitation requires user interaction, typically in the form of a user or application initiating a connection to an attacker-controlled SQL Server endpoint.

Successful exploitation grants the attacker code execution with the privileges of the calling process, which is often a service account, ETL tool, reporting application, or developer workstation utility.

Root Cause

The root cause is improper validation of length or size fields in data received from a SQL Server. When malformed values are processed, the driver writes past the bounds of a heap allocation, corrupting adjacent memory. An attacker who controls the server-side response can shape the overflow to overwrite function pointers or object metadata and redirect execution flow.

Attack Vector

The attack is network-based and requires no authentication on the target application. The attacker hosts a rogue SQL Server and induces a victim to connect, for example through phishing that delivers a connection string, a modified ODBC data source, a tampered linked server, or a compromised configuration file. Once the OLE DB Driver parses the malicious server response, the overflow is triggered and code executes in the client process. Microsoft has not reported in-the-wild exploitation, and no public proof-of-concept is currently available.

No verified exploit code is publicly available. Refer to the Microsoft Security Update Guide entry for CVE-2024-28926 for vendor technical details.

Detection Methods for CVE-2024-28926

Indicators of Compromise

Outbound TCP connections from application servers, BI tools, or developer workstations to unexpected SQL Server endpoints on port 1433 or dynamic TDS ports.
Crashes or unexpected restarts of processes that load msoledbsql.dll or sqlncli11.dll, often visible in Windows Error Reporting (WER) and Application event logs.
Child processes (for example cmd.exe, powershell.exe, rundll32.exe) spawned by applications that normally only perform database I/O.
New or modified ODBC data sources, linked servers, or connection strings pointing to untrusted hosts.

Detection Strategies

Hunt for processes loading the OLE DB Driver module msoledbsql.dll and subsequently initiating connections to non-corporate IP ranges.
Correlate TDS traffic with process telemetry to identify clients connecting to SQL Server instances outside an approved allowlist.
Alert on heap corruption signatures in WER reports for processes that import the OLE DB Driver.
Inspect SQL Server linked server definitions and SSIS packages for recently added remote data sources.

Monitoring Recommendations

Maintain an inventory of hosts where the OLE DB Driver is installed and monitor their outbound database connections.
Forward Sysmon Event ID 3 (network connect) and Event ID 7 (image load) for processes referencing OLE DB Driver binaries to a central SIEM.
Track installed versions of msoledbsql via software inventory and flag systems below the patched version.

How to Mitigate CVE-2024-28926

Immediate Actions Required

Apply the security update referenced in the Microsoft Security Update Guide for CVE-2024-28926 to all systems with the OLE DB Driver installed.
Update SQL Server 2019 and SQL Server 2022 x64 deployments to the cumulative update that ships the fixed driver.
Restrict outbound TCP 1433 and related TDS ports at egress firewalls to known-good SQL Server hosts.
Audit linked servers, ODBC DSNs, and application connection strings for references to untrusted endpoints.

Patch Information

Microsoft released fixed builds of the Microsoft OLE DB Driver for SQL Server (msoledbsql) and corresponding SQL Server 2019 and 2022 cumulative updates on April 9, 2024. Patch binaries and download links are listed in the Microsoft Security Update Guide entry for CVE-2024-28926. Both standalone driver installers and SQL Server CUs must be applied where applicable, because the driver is redistributed independently of the database engine.

Workarounds

Block outbound connections to untrusted SQL Server endpoints using host-based or perimeter firewalls.
Enforce application allowlisting so only approved processes can load msoledbsql.dll.
Disable or remove unused linked servers and ODBC data sources that point to external hosts.
Educate users and developers to avoid opening untrusted .udl, .dsn, or connection-string files.

bash

# Inventory installed OLE DB Driver versions on Windows hosts
Get-WmiObject -Class Win32_Product | \
  Where-Object { $_.Name -like "*OLE DB Driver*for SQL Server*" } | \
  Select-Object Name, Version, InstallDate

# Block outbound TDS traffic to non-approved SQL Servers
New-NetFirewallRule -DisplayName "Block-Untrusted-SQL-TDS" \
  -Direction Outbound -Protocol TCP -RemotePort 1433 \
  -RemoteAddress 0.0.0.0/0 -Action Block