CVE-2024-28937: ODBC Driver for SQL Server RCE Vulnerability

CVE-2024-28937 Overview

CVE-2024-28937 is a remote code execution vulnerability in the Microsoft ODBC Driver for SQL Server. The flaw is rooted in a heap-based buffer overflow [CWE-122] within the driver's data handling routines. An attacker who convinces a user to connect to a malicious SQL Server instance can trigger memory corruption and execute arbitrary code in the context of the calling process. The issue affects the ODBC driver across Windows, Linux, and macOS, as well as SQL Server 2019, SQL Server 2022, Visual Studio 2019, and Visual Studio 2022 deployments that ship the vulnerable driver.

Critical Impact
Successful exploitation allows an attacker to run arbitrary code on the client system with the privileges of the user running the ODBC application, leading to full host compromise.

Affected Products

Microsoft ODBC Driver for SQL Server (Windows, Linux, macOS)
Microsoft SQL Server 2019 and SQL Server 2022 (x64)
Microsoft Visual Studio 2019 and Visual Studio 2022

Discovery Timeline

2024-04-09 - Microsoft publishes advisory and security update for CVE-2024-28937
2024-04-09 - CVE-2024-28937 published to NVD
2025-01-14 - Last updated in NVD database

Technical Details for CVE-2024-28937

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in the Microsoft ODBC Driver for SQL Server. The driver processes network responses from a SQL Server endpoint and writes attacker-influenced data into a heap buffer without sufficient bounds enforcement. When the response payload exceeds the allocated buffer, adjacent heap structures are overwritten. An attacker who controls the server-side response can shape the overflow to corrupt function pointers, vtables, or heap metadata. This corruption can be leveraged to redirect execution and run arbitrary code inside the client application linked against the ODBC driver.

The issue is reachable over the network and requires user interaction, since the victim must initiate a connection to the attacker-controlled SQL Server. No prior authentication is required on the attacker side. Exploitation impacts the confidentiality, integrity, and availability of the host running the ODBC client.

Root Cause

The root cause is improper validation of length fields in data returned by a SQL Server during client connection or query processing. The driver allocates a fixed-size heap buffer based on assumed protocol limits, then copies attacker-controlled bytes into that buffer. A malformed Tabular Data Stream (TDS) response can supply oversized values that exceed the destination buffer, producing the heap overflow described by [CWE-122].

Attack Vector

An attacker hosts a malicious server that speaks the SQL Server TDS protocol. The attacker convinces a developer, administrator, or application to connect to this server using a vulnerable ODBC driver, for example through a phishing lure, a manipulated connection string, or a poisoned data source name. Once the connection initiates, the attacker returns a crafted response that overflows the heap buffer in the client driver. The resulting memory corruption is converted into arbitrary code execution within the process that loaded the ODBC driver, such as sqlcmd.exe, an IIS worker, a SQL Server Integration Services process, or a Visual Studio data tools component.

No verified proof-of-concept code is publicly available. Refer to the Microsoft Security Update Guide for CVE-2024-28937 for vendor technical details.

Detection Methods for CVE-2024-28937

Indicators of Compromise

Outbound TDS connections (TCP/1433 or custom SQL ports) from workstations, developer machines, or application servers to untrusted external IP addresses.
Unexpected child processes spawned by ODBC-linked binaries such as sqlcmd.exe, bcp.exe, devenv.exe, or custom applications using msodbcsql*.dll.
Crash dumps or Windows Error Reporting events referencing msodbcsql17.dll, msodbcsql18.dll, or libmsodbcsql with heap corruption signatures.

Detection Strategies

Hunt for processes loading msodbcsql*.dll that subsequently launch shells, scripting engines, or LOLBins such as cmd.exe, powershell.exe, or rundll32.exe.
Inspect EDR telemetry for ODBC client processes performing network connections to non-corporate SQL endpoints, especially over the public internet.
Correlate application crash events with subsequent process injection or persistence activity originating from the same parent.

Monitoring Recommendations

Inventory hosts running vulnerable versions of the ODBC Driver for SQL Server, SQL Server 2019/2022, and Visual Studio 2019/2022, and track patch compliance.
Alert on connection strings or DSN configurations pointing at unapproved external SQL Server hostnames.
Forward Sysmon process and image-load events for msodbcsql* modules into a central SIEM for retrospective hunting.

How to Mitigate CVE-2024-28937

Immediate Actions Required

Apply the security updates referenced in the Microsoft Security Update Guide for CVE-2024-28937 on all systems with the ODBC driver, SQL Server 2019/2022, or Visual Studio 2019/2022 installed.
Identify embedded copies of msodbcsql17.dll and msodbcsql18.dll shipped with third-party applications and update them to fixed versions.
Restrict outbound traffic to TCP/1433 and other SQL ports so clients can only reach approved internal database servers.

Patch Information

Microsoft released fixed versions of the ODBC Driver 17 and 18 for SQL Server alongside the April 2024 security updates for SQL Server 2019, SQL Server 2022, Visual Studio 2019, and Visual Studio 2022. Consult the Microsoft Security Update Guide for CVE-2024-28937 for the specific build numbers per platform (Windows, Linux distributions, macOS) and integrate them into standard patch cycles.

Workarounds

Block egress to untrusted SQL Server endpoints at the perimeter and host firewall until patching is complete.
Require connections only to internal, authenticated SQL Server instances through allow-listed DSNs and connection strings.
Train developers and administrators to avoid connecting tools such as sqlcmd, Azure Data Studio, or SQL Server Management Studio to untrusted servers.

bash

# Example: block outbound SQL traffic to non-corporate networks on Linux clients
# Replace 10.0.0.0/8 with your approved internal SQL subnet
iptables -A OUTPUT -p tcp --dport 1433 -d 10.0.0.0/8 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 1433 -j REJECT

# Verify installed ODBC driver version on Windows
reg query "HKLM\SOFTWARE\ODBC\ODBCINST.INI\ODBC Driver 18 for SQL Server" /v Driver