CVE-2024-28938: ODBC Driver for SQL Server RCE Flaw

CVE-2024-28938 Overview

CVE-2024-28938 is a remote code execution vulnerability in the Microsoft ODBC Driver for SQL Server. The flaw is rooted in an out-of-bounds read condition tracked as [CWE-125], which an attacker can leverage to execute code in the context of the calling application. Exploitation requires user interaction, typically by inducing a target to connect a vulnerable client to an attacker-controlled SQL Server. The vulnerability affects the ODBC driver across Windows, Linux, and macOS, and ships within Microsoft SQL Server 2019, SQL Server 2022, Visual Studio 2019, and Visual Studio 2022. Microsoft published the advisory on April 9, 2024.

Critical Impact

A successful attack yields remote code execution on the client connecting to a malicious SQL Server, leading to full confidentiality, integrity, and availability compromise.

Affected Products

• Microsoft ODBC Driver for SQL Server (Windows, Linux, macOS)
• Microsoft SQL Server 2019 and SQL Server 2022 (x64)
• Microsoft Visual Studio 2019 and Visual Studio 2022

Discovery Timeline

• 2024-04-09 - CVE-2024-28938 published to NVD
• 2025-01-14 - Last updated in NVD database

Technical Details for CVE-2024-28938

Vulnerability Analysis

The vulnerability resides in how the Microsoft ODBC Driver for SQL Server parses data received from a SQL Server endpoint. An out-of-bounds read [CWE-125] occurs when the driver processes maliciously crafted server responses, allowing the read to extend past the bounds of an allocated buffer. The condition can be steered to corrupt control data and divert execution flow inside the client process. Because the driver is loaded by data tools, business applications, and developer environments, the impacted attack surface is broad. Microsoft assesses the issue as enabling remote code execution rather than only information disclosure.

Root Cause

The root cause is improper bounds checking when the driver reads structured fields returned by a SQL Server during a Tabular Data Stream (TDS) exchange. Malformed length or offset values in server-supplied packets cause the driver to read beyond the intended buffer. Microsoft has not publicly released code-level details. Refer to the Microsoft CVE-2024-28938 Advisory for vendor specifics.

Attack Vector

The attack is network-based but requires a user to initiate or accept a connection to an attacker-controlled SQL Server instance. Phishing lures, malicious connection strings embedded in shared projects, or compromised database hosts on a corporate network are realistic delivery paths. Once the client connects, the malicious server returns crafted TDS responses that trigger the out-of-bounds read and resulting code execution in the client process.

Detection Methods for CVE-2024-28938

Indicators of Compromise

• Outbound TDS connections (TCP/1433 or custom ports) from workstations, developer machines, or application servers to untrusted or unexpected SQL Server hosts.
• Crash or unexpected termination events in processes that load msodbcsql*.dll, sqlncli*.dll, or equivalent driver binaries on Linux and macOS.
• Child processes spawned from applications that normally only perform database I/O, such as Excel, Power BI, SSMS, or Visual Studio.

Detection Strategies

• Hunt for process creation events where ODBC-consuming applications spawn shells, scripting hosts, or LOLBins shortly after establishing a SQL connection.
• Inspect EDR telemetry for memory access violations in modules associated with the Microsoft ODBC Driver for SQL Server.
• Correlate new outbound database connections with anomalous DNS resolutions or connections to external IP ranges.

Monitoring Recommendations

• Inventory hosts where vulnerable ODBC driver versions and SQL Server tooling are installed, then alert on connections from those hosts to non-approved SQL endpoints.
• Enable command-line and module-load auditing on developer workstations and reporting servers to capture exploitation artifacts.
• Forward ODBC and application logs to a centralized SIEM for retention and behavioral analysis.

How to Mitigate CVE-2024-28938

Immediate Actions Required

• Apply the Microsoft security updates for the ODBC Driver for SQL Server on Windows, Linux, and macOS as described in the vendor advisory.
• Update SQL Server 2019, SQL Server 2022, Visual Studio 2019, and Visual Studio 2022 installations that bundle the affected driver.
• Restrict outbound TCP/1433 and other SQL Server ports from user workstations to only sanctioned database servers.

Patch Information

Microsoft addressed CVE-2024-28938 in the April 2024 security update cycle. Patched driver builds and bundled installer updates are listed in the Microsoft CVE-2024-28938 Advisory. Administrators should validate the installed msodbcsql version on each host after deployment and confirm that older side-by-side driver versions have been removed.

Workarounds

• Block egress connections to untrusted SQL Server endpoints at the network perimeter and on host firewalls until patches are deployed.
• Educate developers and analysts to avoid connecting tooling to unverified database hosts received via email, chat, or shared project files.
• Where feasible, enforce encrypted connections with server certificate validation to reduce the risk of connecting to spoofed SQL Server instances.

# Verify installed Microsoft ODBC Driver for SQL Server version
# Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\ODBC\ODBCINST.INI\ODBC Driver 18 for SQL Server" |
  Select-Object DriverODBCVer, Driver

# Linux (Debian/Ubuntu)
dpkg -l | grep msodbcsql

# macOS (Homebrew)
brew list --versions msodbcsql18