CVE-2024-29043: Microsoft ODBC Driver RCE Vulnerability

CVE-2024-29043 Overview

CVE-2024-29043 is a remote code execution vulnerability in the Microsoft ODBC Driver for SQL Server. The flaw is rooted in a use-after-free condition [CWE-416] in the driver's handling of database connections. Microsoft published the advisory on April 9, 2024, covering the ODBC Driver across Windows, Linux, and macOS, as well as SQL Server 2019 and SQL Server 2022 installations that ship the affected driver.

Exploitation requires a victim to connect to an attacker-controlled SQL Server instance. When this occurs, a crafted server response can trigger code execution in the context of the client application using the ODBC driver.

Critical Impact
Successful exploitation allows an attacker controlling a malicious SQL Server endpoint to execute arbitrary code on a client system that initiates an ODBC connection, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

Microsoft ODBC Driver for SQL Server (Windows, Linux, macOS)
Microsoft SQL Server 2019 (x64)
Microsoft SQL Server 2022 (x64)

Discovery Timeline

2024-04-09 - CVE-2024-29043 published to NVD and Microsoft Security Response Center advisory released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29043

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in the Microsoft ODBC Driver for SQL Server. The driver mishandles object lifetime during connection processing, allowing a freed memory region to be referenced after release. An attacker who controls the SQL Server endpoint a client connects to can shape the server-side responses to influence the contents of the freed allocation and gain control over execution flow.

The attack is network-based and requires user interaction, since a user or application must initiate a connection to the attacker's malicious server. No prior authentication on the client is required. When exploitation succeeds, the attacker executes code with the privileges of the process invoking the ODBC driver, which often runs in the security context of the connecting application or service account.

Root Cause

The root cause is improper memory management within the ODBC driver's connection handling logic. A pointer to an object that has been freed continues to be used, and the contents of that memory can be influenced by data returned from the remote SQL Server. This produces a controlled use-after-free that can be steered toward arbitrary code execution.

Attack Vector

The attack vector is network-based with required user interaction. The attacker hosts a malicious SQL Server instance and induces a user, administrator, or automated job to open an ODBC connection to it. This can be achieved through phishing, malicious connection strings embedded in documents or scripts, DNS or routing manipulation, or compromise of an intermediate proxy. Once the client connects, the malicious server returns crafted protocol responses that trigger the use-after-free and load attacker-controlled code into the client process.

No verified public proof-of-concept is currently available. The EPSS probability sits in a moderate range, reflecting interest in the class of bug despite no confirmed in-the-wild exploitation.

Detection Methods for CVE-2024-29043

Indicators of Compromise

Outbound TCP connections from workstations or servers to unknown SQL Server endpoints on port 1433 or non-standard SQL ports.
Unexpected child processes spawned by applications that load msodbcsql.dll or the Linux/macOS equivalents libmsodbcsql.so / libmsodbcsql.dylib.
Crash dumps or Windows Error Reporting events involving the ODBC driver immediately following an outbound database connection.
ODBC driver versions present in the environment that predate the April 2024 Microsoft security update.

Detection Strategies

Inventory all systems with the Microsoft ODBC Driver for SQL Server installed and compare versions against the patched baseline published in the Microsoft advisory.
Hunt for SQL client processes establishing connections to external or non-corporate IP ranges, which is anomalous in most enterprise environments.
Monitor for memory access violations or unexpected module loads inside processes hosting the ODBC driver.

Monitoring Recommendations

Log all ODBC connection attempts and alert on connections to destinations outside the approved database inventory.
Enable Windows Defender Exploit Guard or equivalent platform mitigations on hosts where ODBC clients run, and forward telemetry to a centralized analytics platform.
Track patch compliance for the ODBC driver across Windows, Linux, and macOS endpoints, including build servers, ETL hosts, and developer workstations.

How to Mitigate CVE-2024-29043

Immediate Actions Required

Apply the Microsoft security update for the ODBC Driver for SQL Server referenced in the Microsoft CVE-2024-29043 advisory across all Windows, Linux, and macOS systems.
Patch SQL Server 2019 and SQL Server 2022 installations that bundle the vulnerable driver, including management workstations.
Audit application servers, BI tooling, and developer machines for outdated msodbcsql installations and prioritize remediation.
Restrict outbound TCP/1433 and other SQL ports at the network perimeter so clients cannot reach untrusted external SQL Server endpoints.

Patch Information

Microsoft released fixed versions of the ODBC Driver for SQL Server on April 9, 2024. Refer to the Microsoft Security Response Center advisory for CVE-2024-29043 for the exact driver build numbers per platform and for the corresponding SQL Server 2019 and SQL Server 2022 cumulative updates.

Workarounds

Block outbound connections to untrusted SQL Server endpoints using host and network firewall rules until patching completes.
Enforce application allow-listing so only approved tools can invoke the ODBC driver and initiate database connections.
Train users and developers to reject unsolicited connection strings or .udl / .odc files received over email or chat.

bash

# Example: Windows firewall rule to block outbound SQL connections to non-corporate ranges
New-NetFirewallRule -DisplayName "Block Outbound SQL 1433" \
  -Direction Outbound \
  -Protocol TCP \
  -RemotePort 1433 \
  -RemoteAddress Any \
  -Action Block \
  -Profile Any

# Example: verify installed ODBC driver version on Windows
Get-OdbcDriver -Name "ODBC Driver * for SQL Server" | Format-List Name, Attribute