CVE-2024-28942 Overview
CVE-2024-28942 is a remote code execution vulnerability in the Microsoft OLE DB Driver for SQL Server. The flaw is rooted in an integer overflow or wraparound condition [CWE-190] within the driver's data handling routines. A network-based attacker can exploit the issue by convincing an authenticated client to connect to a malicious SQL Server instance, triggering code execution in the context of the connecting application.
Critical Impact
Successful exploitation allows attackers to execute arbitrary code on systems running the vulnerable OLE DB Driver, with high impact to confidentiality, integrity, and availability.
Affected Products
- Microsoft OLE DB Driver for SQL Server
- Microsoft SQL Server 2019 (x64)
- Microsoft SQL Server 2022 (x64)
Discovery Timeline
- 2024-04-09 - CVE-2024-28942 published to NVD by Microsoft as part of April 2024 Patch Tuesday
- 2025-01-15 - Last updated in NVD database
Technical Details for CVE-2024-28942
Vulnerability Analysis
The vulnerability resides in the Microsoft OLE DB Driver for SQL Server, a client-side data access component. The driver mishandles arithmetic operations when parsing server-supplied data, producing an integer overflow condition. The overflow leads to incorrect memory allocation or boundary calculations, which can be leveraged to corrupt memory and execute attacker-controlled code.
Because the vulnerability is in the client driver, the attack surface is any application that uses OLE DB to communicate with SQL Server. This includes SQL Server itself when initiating outbound connections, linked server queries, replication agents, and third-party applications relying on the driver.
Exploitation requires user interaction. An attacker must coerce a victim with an installed vulnerable driver to connect to an attacker-controlled SQL Server instance. Once the connection handshake or query response is processed, the malformed response triggers the overflow.
Root Cause
The root cause is an integer overflow [CWE-190] in data-parsing logic within the OLE DB Driver. Length or size values received from the server are used in arithmetic operations without sufficient bounds checking, allowing the result to wrap around and bypass downstream size validation.
Attack Vector
The attack vector is network-based with required user interaction. An attacker hosts a malicious SQL Server endpoint and induces a client application or administrator to initiate a connection. The malicious server returns crafted Tabular Data Stream (TDS) protocol responses that exercise the vulnerable parsing path. No specific code is published; see the Microsoft CVE-2024-28942 Advisory for technical details.
Detection Methods for CVE-2024-28942
Indicators of Compromise
- Outbound SQL Server connections from workstations or servers to unknown or untrusted IP addresses on TCP/1433 or custom SQL ports.
- Unexpected child processes spawned by applications hosting the OLE DB Driver, such as sqlservr.exe, SSMS, or custom data-access clients.
- Crash dumps or Windows Error Reporting events referencing msoledbsql.dll shortly after initiating a database connection.
Detection Strategies
- Inventory endpoints for installed versions of msoledbsql.dll and compare against patched build numbers listed in the Microsoft advisory.
- Monitor process lineage for OLE DB consumers spawning shells, scripting hosts, or LOLBins after database session activity.
- Apply behavioral identification rules to flag SQL client processes executing memory-resident payloads or modifying sensitive registry keys.
Monitoring Recommendations
- Log and review egress connections from database client hosts; restrict outbound TCP/1433 to known SQL Server destinations.
- Capture TDS protocol anomalies at the network boundary using IDS signatures targeting malformed length fields.
- Forward endpoint telemetry to a centralized data lake to correlate driver crashes with subsequent suspicious process activity.
How to Mitigate CVE-2024-28942
Immediate Actions Required
- Apply the April 2024 Microsoft security updates for the OLE DB Driver for SQL Server and SQL Server 2019/2022 on all affected hosts.
- Identify every workstation, server, and application packaging that bundles msoledbsql.dll and update those distributions.
- Restrict outbound SQL Server connectivity from end-user workstations to only sanctioned database endpoints.
Patch Information
Microsoft released fixed builds of the OLE DB Driver alongside SQL Server cumulative updates for SQL Server 2019 and SQL Server 2022. Refer to the Microsoft CVE-2024-28942 Advisory for specific patched version numbers, redistributable installers, and SQL Server cumulative update identifiers applicable to each affected build.
Workarounds
- Block outbound traffic to untrusted SQL Server endpoints at the firewall to reduce exposure until patching is complete.
- Educate administrators and developers to avoid connecting to unverified SQL Server instances, including those received via links or shared connection strings.
- Enforce application allowlisting so unauthorized OLE DB consumers cannot initiate external database connections.
# Verify installed OLE DB Driver version on Windows hosts
(Get-Item "C:\Windows\System32\msoledbsql.dll").VersionInfo | Format-List FileVersion,ProductVersion
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
