CVE-2024-28939: OLE DB Driver for SQL Server RCE Flaw

CVE-2024-28939 Overview

CVE-2024-28939 is a remote code execution vulnerability in the Microsoft OLE DB Driver for SQL Server. The flaw affects the OLE DB Driver component shipped with SQL Server 2019 and SQL Server 2022. Microsoft published the advisory on April 9, 2024 as part of its Patch Tuesday release.

Exploitation requires user interaction: a victim must connect to a malicious SQL Server instance using the vulnerable client driver. Successful exploitation yields code execution in the context of the client process. The vulnerability is associated with [CWE-209] (information exposure through error messages) according to NVD metadata.

Critical Impact
An attacker controlling a malicious SQL Server can execute arbitrary code on any client that connects using the affected OLE DB Driver, compromising confidentiality, integrity, and availability.

Affected Products

Microsoft OLE DB Driver for SQL Server
Microsoft SQL Server 2019 (x64)
Microsoft SQL Server 2022 (x64)

Discovery Timeline

2024-04-09 - CVE-2024-28939 published to NVD and addressed in Microsoft's April 2024 security update
2025-01-15 - Last updated in NVD database

Technical Details for CVE-2024-28939

Vulnerability Analysis

The OLE DB Driver for SQL Server is the client-side data access component used by applications to connect to SQL Server instances. The driver processes Tabular Data Stream (TDS) protocol messages returned by the server. CVE-2024-28939 enables a malicious server to return crafted responses that trigger remote code execution in the client process.

NVD assigns CWE-209 to this issue, indicating that information exposure through error or response handling contributes to the exploitable condition. The attack vector is network-based, requires low complexity, no privileges, and a single user action to initiate the connection. The EPSS score is 2.268% (80.72 percentile), reflecting moderately elevated exploitation likelihood relative to the broader CVE population.

Root Cause

The defect resides in how the OLE DB Driver parses server-supplied data structures during a TDS exchange. Improper validation of attacker-controlled fields allows memory corruption or unsafe code paths to be reached on the client. Microsoft has not published low-level technical detail beyond the advisory.

Attack Vector

An attacker stands up a hostile SQL Server endpoint and induces a victim to connect — through phishing, a malicious connection string in a document, or a compromised application. Once the client driver processes the malicious server response, the attacker gains code execution at the privilege level of the connecting application. Refer to the Microsoft CVE-2024-28939 Advisory for vendor-supplied detail.

Detection Methods for CVE-2024-28939

Indicators of Compromise

Outbound TDS connections (TCP/1433 or custom ports) from workstations or application servers to unknown or untrusted external IP addresses.
Unexpected child processes spawned by applications that link msoledbsql.dll or use ADO/OLE DB providers.
Crash dumps or Windows Error Reporting entries referencing msoledbsql.dll shortly before suspicious process activity.

Detection Strategies

Inventory hosts where msoledbsql.dll is loaded and compare installed versions against the patched baseline released in Microsoft's April 2024 update.
Hunt for SQL Server connection strings pointing to non-corporate hostnames within scripts, Office documents, and recently created files.
Correlate process creation events from applications using the OLE DB Driver with subsequent execution of LOLBins such as cmd.exe, powershell.exe, or rundll32.exe.

Monitoring Recommendations

Enable endpoint logging for module loads of msoledbsql.dll and alert when load events originate from non-standard parent processes.
Monitor egress firewall logs for SQL Server protocol traffic destined to external networks and block where not explicitly required.
Review Microsoft Defender and EDR telemetry for client-side SQL Server driver crashes that may indicate exploitation attempts.

How to Mitigate CVE-2024-28939

Immediate Actions Required

Apply the April 2024 Microsoft OLE DB Driver for SQL Server update to all systems that connect to SQL Server instances, including application servers, developer workstations, and SQL Server hosts themselves.
Install the SQL Server 2019 and SQL Server 2022 cumulative updates that ship the patched driver where applicable.
Identify and update redistributed copies of msoledbsql.dll bundled with third-party applications.

Patch Information

Microsoft released the fix on April 9, 2024. Download the updated MSOLEDBSQL driver and SQL Server cumulative updates as referenced in the Microsoft CVE-2024-28939 Advisory. Confirm post-patch versions across every host that initiates SQL Server connections.

Workarounds

Restrict outbound TCP/1433 and named-instance ports to known-good SQL Server destinations using host or network firewalls.
Educate users not to open connection strings or .udl files from untrusted sources and disable automatic SQL connection prompts in business applications where feasible.
Run applications that consume the OLE DB Driver under least-privilege accounts to limit blast radius if exploitation occurs before patching completes.

bash

# Verify installed OLE DB Driver version on Windows (PowerShell)
Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\MSOLEDBSQL' |
  Select-Object InstalledVersion, ProductVersion

# Enumerate processes currently loading msoledbsql.dll
Get-Process | Where-Object {
  $_.Modules.ModuleName -contains 'msoledbsql.dll'
} | Select-Object Id, ProcessName, Path