CVE-2024-28931: Microsoft ODBC Driver for SQL Server RCE

CVE-2024-28931 Overview

CVE-2024-28931 is a remote code execution vulnerability in the Microsoft ODBC Driver for SQL Server. The flaw is associated with an integer overflow weakness ([CWE-190]) and affects multiple Microsoft products that ship or rely on the driver, including SQL Server 2019, SQL Server 2022, Visual Studio 2019, and Visual Studio 2022. An attacker who can induce a vulnerable client to connect to a malicious or attacker-controlled SQL Server endpoint can trigger memory corruption and execute arbitrary code in the context of the connecting process. Microsoft published the advisory as part of its April 2024 security update cycle.

Critical Impact
Successful exploitation allows an attacker to execute arbitrary code on the client system, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

Microsoft ODBC Driver for SQL Server (Windows, Linux, macOS)
Microsoft SQL Server 2019 and SQL Server 2022 (x64)
Microsoft Visual Studio 2019 and Visual Studio 2022

Discovery Timeline

2024-04-09 - CVE-2024-28931 published to NVD and Microsoft releases security update
2025-01-14 - Last updated in NVD database

Technical Details for CVE-2024-28931

Vulnerability Analysis

The vulnerability resides in the Microsoft ODBC Driver for SQL Server, which provides connectivity between client applications and SQL Server instances using the Tabular Data Stream (TDS) protocol. Exploitation requires user interaction: a victim must be convinced to connect a vulnerable client to a malicious SQL Server controlled by the attacker. Once connected, crafted server responses trigger an integer overflow during data processing, leading to memory corruption and arbitrary code execution in the client process. Because the ODBC driver ships with widely deployed products such as SQL Server Management Studio components, Visual Studio data tooling, and the standalone driver on Windows, Linux, and macOS, the attack surface spans developer workstations and database administration hosts.

Root Cause

The root cause is an integer overflow ([CWE-190]) in the driver's handling of values returned by a remote SQL Server. When a size or length field is processed without adequate bounds validation, arithmetic on attacker-controlled values wraps, producing an undersized buffer allocation followed by an oversized copy. The resulting heap corruption is reachable from data returned in a normal client/server session.

Attack Vector

The attack vector is network-based with user interaction required. An attacker hosts a malicious SQL Server endpoint and lures a user—through phishing, a crafted connection string, a malicious project file in Visual Studio, or a compromised internal service—into initiating a connection. The malicious server returns a crafted TDS response that triggers the integer overflow during result-set processing in the ODBC driver, executing code with the privileges of the connecting application.

No verified public proof-of-concept code is available. See the Microsoft CVE-2024-28931 Advisory for vendor technical details.

Detection Methods for CVE-2024-28931

Indicators of Compromise

Outbound connections from developer workstations or database tooling to untrusted external hosts on TCP/1433 or other SQL Server ports.
Unexpected child processes spawned by sqlservr.exe, devenv.exe, ssms.exe, or processes that load msodbcsql*.dll.
Crash or exception events in applications loading the Microsoft ODBC Driver for SQL Server shortly after establishing a remote connection.

Detection Strategies

Inventory endpoints and servers for installed versions of msodbcsql17.dll and msodbcsql18.dll and compare against Microsoft's patched versions.
Monitor process telemetry for memory corruption indicators—access violations, control-flow guard alerts, and heap manager errors—originating from modules that include the ODBC driver.
Alert on ODBC client connections to SQL Server endpoints outside approved network ranges or cloud database tenants.

Monitoring Recommendations

Enable EDR behavioral telemetry on developer and DBA workstations to capture suspicious child-process creation from data tooling.
Log and review DNS resolutions and firewall flows for SQL Server protocol traffic crossing perimeter boundaries.
Correlate authentication failures and abrupt session terminations on legitimate SQL Server hosts that may indicate redirection or man-in-the-middle attempts.

How to Mitigate CVE-2024-28931

Immediate Actions Required

Apply Microsoft's April 2024 security updates for the ODBC Driver for SQL Server, SQL Server 2019, SQL Server 2022, Visual Studio 2019, and Visual Studio 2022.
Inventory all systems—including Linux and macOS build agents—that ship the Microsoft ODBC Driver for SQL Server and patch each instance.
Restrict outbound TCP/1433 and related SQL Server ports from client subnets to only approved database endpoints.

Patch Information

Microsoft has released fixed versions of the ODBC Driver for SQL Server and updated SQL Server and Visual Studio packages. Refer to the Microsoft CVE-2024-28931 Advisory for the complete list of patched driver versions and product-specific update guidance.

Workarounds

Block outbound connections from developer and end-user workstations to untrusted SQL Server endpoints at the network perimeter.
Train users to avoid opening unsolicited connection strings, .udl files, or Visual Studio project files from untrusted sources.
Where patching is delayed, isolate hosts that must run vulnerable driver versions on segmented networks with strict egress filtering.

bash

# Verify installed ODBC driver version on Windows
reg query "HKLM\SOFTWARE\ODBC\ODBCINST.INI\ODBC Driver 18 for SQL Server" /v DriverODBCVer

# Verify installed ODBC driver version on Linux
odbcinst -q -d -n "ODBC Driver 18 for SQL Server"
dpkg -l | grep msodbcsql