CVE-2024-28945: OLE DB Driver for SQL Server RCE Flaw

CVE-2024-28945 Overview

CVE-2024-28945 is a remote code execution vulnerability in the Microsoft OLE DB Driver for SQL Server. The flaw originates from an integer underflow condition [CWE-191] in the driver's data handling routines. Exploitation requires an authenticated user to connect a vulnerable client to an attacker-controlled SQL Server instance. Successful exploitation grants the attacker code execution in the context of the connecting client application.

Microsoft published the advisory on April 9, 2024, and the issue affects the standalone OLE DB Driver as well as SQL Server 2019 and SQL Server 2022 installations that ship the driver.

Critical Impact
An attacker controlling a malicious SQL Server endpoint can execute arbitrary code on any client that connects using a vulnerable OLE DB Driver, leading to full compromise of the client process.

Affected Products

Microsoft OLE DB Driver for SQL Server
Microsoft SQL Server 2019 (x64)
Microsoft SQL Server 2022 (x64)

Discovery Timeline

2024-04-09 - CVE-2024-28945 published to NVD
2024-04-09 - Microsoft released security update via MSRC advisory
2025-01-15 - Last updated in NVD database

Technical Details for CVE-2024-28945

Vulnerability Analysis

The vulnerability resides in the Microsoft OLE DB Driver (msoledbsql), the native client library used by Windows applications to communicate with SQL Server over the Tabular Data Stream (TDS) protocol. The driver mishandles size or length calculations when parsing responses from a SQL Server endpoint, producing an integer underflow [CWE-191]. The underflow causes downstream buffer arithmetic to wrap, allowing memory corruption inside the client process.

An attacker who can lure a victim into connecting to a hostile SQL Server, or who can intercept and manipulate TDS responses on the network path, can shape malformed packets that trigger the underflow. The resulting corruption is leveraged to redirect execution flow within the client application loading the driver. Because the driver runs in-process, code execution occurs at the privilege level of the application initiating the connection, including services and scheduled tasks that perform automated database queries.

The vulnerability requires user interaction, typically clicking through a connection prompt, opening a malicious linked workbook, or executing a script that targets the rogue server. No prior authentication to the attacker's server is needed.

Root Cause

The root cause is an integer underflow in length validation logic within the OLE DB Driver. A length field derived from server-controlled input is decremented or subtracted without first verifying that the operand is greater than the value being subtracted, producing a very large unsigned value that bypasses subsequent bounds checks.

Attack Vector

The attack vector is network-based and exploits the trust relationship between OLE DB clients and SQL Server endpoints. An attacker stands up a malicious server emulating the TDS protocol, then induces a victim to connect through phishing, a poisoned ODBC data source, a malicious Excel data connection, or a compromised connection string. Once the client initiates the handshake, the attacker returns crafted TDS responses that trigger the underflow and deliver a payload.

No verified public exploit code is available for CVE-2024-28945. Refer to the Microsoft Vulnerability Update CVE-2024-28945 for vendor-confirmed technical details.

Detection Methods for CVE-2024-28945

Indicators of Compromise

Outbound TCP connections from workstations or servers to unexpected SQL Server endpoints on port 1433 or custom TDS ports.
Unsigned or unexpected child processes spawned from applications that load msoledbsql.dll, such as excel.exe, powershell.exe, or custom line-of-business binaries.
Crash events or Windows Error Reporting entries referencing msoledbsql.dll with access violation exceptions.

Detection Strategies

Inventory hosts loading msoledbsql.dll and correlate driver versions against the patched build published in the MSRC advisory.
Hunt for process trees where Office applications, scripting hosts, or ETL tools spawn shells or LOLBins after establishing a SQL connection.
Inspect outbound TDS traffic to non-corporate IP ranges and flag connections to newly registered or low-reputation domains.

Monitoring Recommendations

Enable PowerShell, WMI, and process creation logging on hosts that regularly use OLE DB connections.
Forward driver crash telemetry and Sysmon Event ID 1, 7, and 11 records to your SIEM for correlation.
Alert on creation or modification of .udl, .odc, or connection string files pointing to external SQL Server hosts.

How to Mitigate CVE-2024-28945

Immediate Actions Required

Apply the security updates referenced in the Microsoft Vulnerability Update CVE-2024-28945 to all systems running the OLE DB Driver, including SQL Server 2019 and SQL Server 2022 hosts.
Audit client systems for the installed msoledbsql version and prioritize patching for endpoints used by database administrators, BI analysts, and integration servers.
Block outbound TCP/1433 and other TDS ports at the perimeter except to sanctioned database hosts.

Patch Information

Microsoft released a patched version of the OLE DB Driver for SQL Server alongside the April 9, 2024 Patch Tuesday cycle. The same update is bundled into the cumulative updates for SQL Server 2019 and SQL Server 2022. Standalone driver installations must be upgraded independently, as SQL Server cumulative updates do not always replace separately deployed msoledbsql packages on client machines. Consult the MSRC advisory for the exact fixed build numbers.

Workarounds

Restrict outbound database connections to an allowlist of trusted SQL Server endpoints using host or network firewalls.
Disable automatic execution of external data connections in Office applications and remove cached untrusted connection files.
Require encrypted TDS connections with certificate validation to reduce the feasibility of in-path manipulation.

bash

# Query installed OLE DB Driver version on Windows hosts
Get-WmiObject Win32_Product -Filter "Name LIKE '%OLE DB Driver%for SQL Server%'" |
    Select-Object Name, Version, InstallDate