CVE-2024-29044: OLE DB Driver for SQL Server RCE Flaw

CVE-2024-29044 Overview

CVE-2024-29044 is a remote code execution vulnerability in the Microsoft OLE DB Driver for SQL Server. The flaw is categorized as a heap-based buffer overflow [CWE-122] and affects systems that connect to attacker-controlled SQL Server endpoints. Successful exploitation allows an attacker to execute arbitrary code in the context of the client process invoking the driver. Microsoft addressed the issue in the April 2024 Patch Tuesday release. The vulnerability requires user interaction, typically by inducing a victim to connect to a malicious SQL Server instance.

Critical Impact

Remote code execution on client systems connecting to attacker-controlled SQL Server instances through the OLE DB driver, with high impact to confidentiality, integrity, and availability.

Affected Products

• Microsoft OLE DB Driver for SQL Server
• Microsoft SQL Server 2019 (x64)
• Microsoft SQL Server 2022 (x64)

Discovery Timeline

• 2024-04-09 - CVE-2024-29044 published to the National Vulnerability Database (NVD)
• 2024-04-09 - Microsoft released security update guidance for CVE-2024-29044
• 2025-01-15 - Last updated in NVD database

Technical Details for CVE-2024-29044

Vulnerability Analysis

The vulnerability resides in the Microsoft OLE DB Driver for SQL Server, a client-side data access component used by applications to communicate with SQL Server instances. The flaw is a heap-based buffer overflow that arises during the processing of responses returned from a SQL Server endpoint. An attacker who controls the server side of the connection can return crafted data that overflows a heap buffer in the driver, corrupting adjacent memory.

Exploitation results in code execution within the process loading the driver, which is typically a client application or service account. The attack vector is network-based, requires no authentication on the client, and requires user interaction such as initiating a connection to the malicious server. The combination of confidentiality, integrity, and availability impact reflects full process compromise on the affected client.

The Exploit Prediction Scoring System (EPSS) places this CVE in the 84th percentile, indicating a higher-than-average likelihood of exploitation activity relative to other published CVEs.

Root Cause

The root cause is improper validation of the size or structure of server-supplied data before it is copied into a heap-allocated buffer inside the OLE DB driver. Without proper bounds checking, oversized or malformed fields write past the end of the destination buffer and corrupt heap metadata or adjacent objects.

Attack Vector

An attacker hosts a malicious SQL Server-compatible endpoint and convinces a victim to initiate an OLE DB connection to it. This can occur through phishing links to applications using OLE DB, malicious connection strings, or compromised internal services that proxy connections. Once the client driver parses the crafted server response, the heap overflow triggers and control flow can be hijacked. The vulnerability cannot be triggered without an outbound connection from the victim to the attacker-controlled server.

No public proof-of-concept exploit has been released for CVE-2024-29044, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Microsoft Security Update Guide for CVE-2024-29044 for vendor technical details.

Detection Methods for CVE-2024-29044

Indicators of Compromise

• Outbound TCP connections from workstations or servers to untrusted external hosts on SQL Server ports (default 1433) or other custom SQL listener ports.
• Unexpected child processes spawned by applications that load msoledbsql.dll or related OLE DB components.
• Crashes or unhandled exceptions in processes consuming the OLE DB driver, particularly heap corruption signatures in Windows Error Reporting.
• Anomalous DNS queries resolving to attacker infrastructure shortly before SQL connection attempts.

Detection Strategies

• Inventory hosts loading msoledbsql.dll and correlate with outbound SQL traffic to detect connections to non-approved database servers.
• Monitor process behavior for applications that load the OLE DB driver and subsequently spawn shells, scripting engines, or LOLBins.
• Apply EDR behavioral rules that flag heap corruption indicators followed by code execution within database client processes.

Monitoring Recommendations

• Log and alert on egress SQL Server traffic leaving the corporate network boundary, since legitimate SQL connections are usually internal.
• Centralize Windows Error Reporting and application crash telemetry to detect repeated faults in processes using the OLE DB driver.
• Track installed versions of msoledbsql.dll across the fleet and alert on hosts running unpatched builds.

How to Mitigate CVE-2024-29044

Immediate Actions Required

• Apply the Microsoft security update for CVE-2024-29044 to all systems running the OLE DB Driver for SQL Server, SQL Server 2019, and SQL Server 2022.
• Identify and update standalone deployments of msoledbsql.dll bundled with third-party applications, as these are not always updated through Windows Update.
• Restrict outbound SQL Server connections at the network perimeter so clients can only reach approved internal database servers.
• Educate users not to open connection strings, ODBC/OLE DB data source files, or office documents from untrusted sources that may trigger external SQL connections.

Patch Information

Microsoft published patched versions of the OLE DB Driver for SQL Server and corresponding SQL Server 2019 and 2022 cumulative updates as part of the April 2024 security release. Refer to the Microsoft Security Update Guide for CVE-2024-29044 for the current driver version and download links. Administrators should verify that all client systems, application servers, and SQL Server hosts have the updated driver installed, since the driver can be redistributed independently of the SQL Server engine.

Workarounds

• Block outbound traffic to untrusted hosts on TCP 1433 and custom SQL listener ports using host-based and network firewalls.
• Remove the OLE DB Driver for SQL Server from systems that do not require it, and standardize on a single managed version where possible.
• Use application allowlisting to prevent execution of unsigned binaries that may be dropped following exploitation of a client process.

# Example: Windows Defender Firewall rule restricting outbound SQL connections
# to an approved internal database server only
New-NetFirewallRule -DisplayName "Block Outbound SQL Except Approved" `
  -Direction Outbound -Protocol TCP -RemotePort 1433 `
  -RemoteAddress "!10.10.20.5" -Action Block

# Verify installed OLE DB driver version
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\MSOLEDBSQL" |
  Select-Object InstalledVersion