CVE-2024-28928 Overview
CVE-2024-28928 is a remote code execution vulnerability in the Microsoft SQL Server Native Client Object Linking and Embedding Database (OLE DB) Provider. The flaw affects multiple supported SQL Server releases and is classified under [CWE-121] Stack-Based Buffer Overflow. An attacker who convinces an authenticated user to connect to a malicious SQL Server instance can execute arbitrary code in the context of the client process. Microsoft published the advisory on July 9, 2024, and the entry was last updated on January 15, 2025.
Critical Impact
Successful exploitation grants remote code execution on the client connecting to an attacker-controlled SQL Server, leading to full compromise of confidentiality, integrity, and availability.
Affected Products
- Microsoft SQL Server 2016 (x64)
- Microsoft SQL Server 2017 and SQL Server 2019 (x64)
- Microsoft SQL Server 2022 (x64)
Discovery Timeline
- 2024-07-09 - CVE-2024-28928 published to NVD with Microsoft advisory release
- 2025-01-15 - Last updated in NVD database
Technical Details for CVE-2024-28928
Vulnerability Analysis
The vulnerability resides in the SQL Server Native Client OLE DB Provider, the component that handles client-side connections to SQL Server instances. The defect is a stack-based buffer overflow [CWE-121] reachable when the client processes crafted server responses. An attacker hosting a malicious SQL Server can return specially formed data that overruns a fixed-size stack buffer in the OLE DB provider. The overflow corrupts return addresses or stack metadata, enabling control of execution flow inside the client process. Exploitation requires user interaction: a victim must initiate a connection to the adversary-controlled server, typically through phishing, a manipulated connection string, or a compromised application. No prior authentication to the attacker server is required, and exploitation complexity is low.
Root Cause
The root cause is insufficient bounds checking on length-prefixed fields within Tabular Data Stream (TDS) responses parsed by the native client. When the provider copies attacker-supplied data into a stack buffer without validating the declared length, adjacent stack memory is overwritten.
Attack Vector
The attack vector is network-based. An attacker stands up a rogue SQL Server endpoint and lures a victim application or administrator into connecting using the Native Client OLE DB Provider. Common delivery mechanisms include malicious Office documents containing external data connections, Power BI or SSIS packages referencing untrusted servers, and modified ODBC/OLE DB connection strings. Once the client connects, the malicious server returns a crafted response that triggers the buffer overflow during result parsing. Code then executes in the security context of the connecting user.
No verified public proof-of-concept code is available. See the Microsoft Security Update Guide for vendor technical details.
Detection Methods for CVE-2024-28928
Indicators of Compromise
- Outbound TDS connections (TCP/1433 or dynamic ports) from workstations or application servers to untrusted external IP addresses.
- Unexpected child processes spawned by applications using sqlncli11.dll, msoledbsql.dll, or sqloledb.dll.
- Crashes in processes that load the SQL Native Client OLE DB provider, with stack corruption signatures in Windows Error Reporting.
Detection Strategies
- Inspect TDS traffic for malformed length fields and abnormally large token payloads that deviate from documented protocol structures.
- Hunt for connection strings in scripts, registry, or DSN configurations pointing to non-corporate SQL endpoints.
- Correlate process creation events where Office, BI, or ETL tools load OLE DB provider DLLs and subsequently spawn cmd.exe, powershell.exe, or rundll32.exe.
Monitoring Recommendations
- Enable PowerShell and Sysmon process-creation logging on hosts running SQL Server Management Studio, SSIS, SSRS, and Power BI Desktop.
- Alert on loads of legacy sqlncli modules, which Microsoft has deprecated, since modern stacks should use MSOLEDBSQL 19 or later.
- Capture and retain DNS and TLS SNI metadata for outbound database connections to identify rogue server destinations.
How to Mitigate CVE-2024-28928
Immediate Actions Required
- Apply the Microsoft July 2024 security updates for all affected SQL Server 2016, 2017, 2019, and 2022 instances and clients.
- Inventory endpoints with the SQL Server Native Client or Microsoft OLE DB Driver installed and prioritize patching workstations used by database administrators and developers.
- Block outbound TCP/1433 and SQL Browser UDP/1434 at perimeter firewalls except to approved internal database servers.
Patch Information
Microsoft released fixed builds through the Security Update Guide. Refer to the Microsoft Security Response Center advisory for CVE-2024-28928 for the specific cumulative update or GDR package matching each SQL Server version and apply it through Windows Update, WSUS, or the Microsoft Update Catalog.
Workarounds
- Restrict user permissions so that interactive accounts cannot establish ad-hoc connections to arbitrary SQL Server endpoints.
- Migrate applications from the deprecated SQL Server Native Client to the supported Microsoft OLE DB Driver for SQL Server, then patch the new driver.
- Enforce egress filtering and DNS allow-listing for database protocols to prevent clients from reaching attacker-controlled servers.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
