CVE-2024-28936: Microsoft ODBC Driver RCE Vulnerability

CVE-2024-28936 Overview

CVE-2024-28936 is a remote code execution vulnerability in the Microsoft ODBC Driver for SQL Server. The flaw is tracked under [CWE-190] (Integer Overflow or Wraparound) and affects client-side connections to attacker-controlled SQL Server endpoints. An attacker who convinces an authenticated user to connect a vulnerable client to a malicious database server can execute arbitrary code in the context of the client process.

The vulnerability impacts the cross-platform ODBC driver on Windows, Linux, and macOS, as well as SQL Server 2019, SQL Server 2022, Visual Studio 2019, and Visual Studio 2022 components that ship the driver.

Critical Impact
Successful exploitation grants full confidentiality, integrity, and availability impact on the targeted client system, enabling code execution with the privileges of the connecting user or service.

Affected Products

Microsoft ODBC Driver for SQL Server (Windows, Linux, macOS)
Microsoft SQL Server 2019 and SQL Server 2022 (x64)
Microsoft Visual Studio 2019 and Visual Studio 2022

Discovery Timeline

2024-04-09 - CVE-2024-28936 published to NVD and addressed in Microsoft's April 2024 Patch Tuesday
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-28936

Vulnerability Analysis

The vulnerability is an integer overflow [CWE-190] in the Microsoft ODBC Driver for SQL Server. The driver mishandles arithmetic on size or length fields when parsing data returned from a SQL Server endpoint. The overflow leads to undersized buffer allocations followed by oversized writes, producing memory corruption in the client process.

Exploitation requires user interaction. A user must initiate an ODBC connection from a vulnerable client to a SQL Server instance controlled by the attacker. The Tabular Data Stream (TDS) traffic returned by that server triggers the flawed arithmetic path inside the driver.

Microsoft classifies this as a Remote Code Execution issue because corruption occurs during normal connection and result-set processing, before higher-level application logic runs. The EPSS probability of 2.415% (81.99 percentile) reflects elevated exploit likelihood relative to typical client-side bugs.

Root Cause

The root cause is unchecked integer arithmetic on length or offset values supplied by the remote SQL Server. When these computed values wrap around, the driver allocates a smaller buffer than required and then writes attacker-controlled bytes past its boundary, corrupting adjacent heap structures.

Attack Vector

The attack vector is network-based but requires user interaction. The attacker must lure a victim into connecting an application that uses the Microsoft ODBC Driver for SQL Server to a malicious server, for example via a crafted connection string, a phishing email containing an .odc or .udl file, or a manipulated data source. No prior authentication to the target client is needed.

No verified public proof-of-concept code is available for this issue. Refer to the Microsoft Security Update for CVE-2024-28936 for vendor technical details.

Detection Methods for CVE-2024-28936

Indicators of Compromise

Outbound TDS connections (TCP/1433 or custom ports) from workstations to untrusted external IP addresses or domains.
Unexpected child processes spawned by applications hosting sqlncli, msodbcsql17, or msodbcsql18 libraries.
Crash dumps or Windows Error Reporting events referencing the ODBC driver module shortly after a SQL connection attempt.

Detection Strategies

Inventory hosts loading vulnerable versions of msodbcsql17.dll, msodbcsql18.dll, or the Linux/macOS equivalents and correlate against patched build numbers from Microsoft.
Hunt for processes loading the ODBC driver that subsequently initiate suspicious child processes such as cmd.exe, powershell.exe, or shell interpreters on Linux and macOS.
Alert on connection strings or .udl files originating from email attachments, downloads, or removable media.

Monitoring Recommendations

Enforce egress filtering so only sanctioned database servers are reachable on TDS ports from client subnets.
Capture process and module-load telemetry from developer workstations and application servers running Visual Studio or SQL Server tooling.
Forward TLS-decrypted SQL traffic logs and EDR telemetry to a centralized analytics platform for behavioral correlation.

How to Mitigate CVE-2024-28936

Immediate Actions Required

Apply the April 2024 Microsoft security updates for the ODBC Driver for SQL Server, SQL Server 2019, SQL Server 2022, and Visual Studio 2019 and 2022 on all affected systems.
Identify and update standalone deployments of msodbcsql17 and msodbcsql18 on Linux and macOS hosts, including container images and CI/CD runners.
Block outbound TCP/1433 and other SQL ports from endpoints that have no business need to reach external database servers.

Patch Information

Microsoft released fixed driver builds and corresponding SQL Server and Visual Studio updates as part of the April 9, 2024 Patch Tuesday cycle. Specific fixed versions and download links are documented in the Microsoft Security Update Guide entry for CVE-2024-28936.

Workarounds

Restrict ODBC client connections to allow-listed internal SQL Server hosts using host-based firewalls or network ACLs.
Remove or disable the Microsoft ODBC Driver for SQL Server on systems that do not require database connectivity until patches are applied.
Educate users to avoid opening untrusted connection files (.udl, .dsn, .odc) and to verify SQL Server hostnames before connecting.

bash

# Example: query installed ODBC driver versions on Windows and Linux
# Windows (PowerShell)
Get-OdbcDriver | Where-Object { $_.Name -like '*SQL Server*' } | Select Name, Platform

# Linux
odbcinst -q -d -n "ODBC Driver 18 for SQL Server"
dpkg -l | grep -E 'msodbcsql(17|18)'