CVE-2024-29046: Microsoft OLE DB Driver for SQL RCE

CVE-2024-29046 Overview

CVE-2024-29046 is a remote code execution vulnerability in the Microsoft OLE DB Driver for SQL Server. The flaw is classified as a heap-based buffer overflow [CWE-122] and affects connections made to malicious or compromised SQL Server endpoints. An attacker who controls a server can deliver a crafted response that triggers memory corruption inside the client driver, leading to arbitrary code execution in the context of the connecting application.

Microsoft published the advisory on April 9, 2024 as part of its monthly security update cycle. Exploitation requires user interaction, since a client must initiate a connection to the attacker-controlled SQL Server instance.

Critical Impact

Successful exploitation allows network-based remote code execution against any application that connects to an attacker-controlled SQL Server through the OLE DB Driver, compromising confidentiality, integrity, and availability.

Affected Products

• Microsoft OLE DB Driver for SQL Server (MSOLEDBSQL)
• Microsoft SQL Server 2019 (x64)
• Microsoft SQL Server 2022 (x64)

Discovery Timeline

• 2024-04-09 - CVE-2024-29046 published to NVD and Microsoft releases security update
• 2025-01-15 - Last updated in NVD database

Technical Details for CVE-2024-29046

Vulnerability Analysis

The vulnerability lives in the Microsoft OLE DB Driver for SQL Server, a client-side database connectivity component widely deployed with SQL Server installations and standalone application stacks. The driver parses Tabular Data Stream (TDS) protocol responses returned by the server during query and connection operations.

A heap-based buffer overflow [CWE-122] occurs when the driver processes a malformed server response. Memory corruption on the heap can be steered to overwrite adjacent allocations or function pointers, enabling control of the instruction pointer. Because the driver runs inside the calling application, code executes with that application's privileges.

The EPSS percentile of 84.77 indicates higher relative likelihood of exploitation activity compared to most CVEs, though no public proof-of-concept or in-the-wild exploitation has been reported.

Root Cause

The root cause is improper validation of length or size fields within TDS protocol data returned by the server. The driver allocates a heap buffer based on attacker-influenced metadata, then writes data into it without bounds enforcement. This pattern enables a classic heap overflow when the actual payload exceeds the allocated region.

Attack Vector

The attack vector is network-based but requires user interaction. The victim application or user must initiate an outbound SQL connection to a server controlled by the attacker. Common exploitation scenarios include:

• Phishing links or documents that trigger SQL connections to attacker-controlled hostnames
• Compromised internal SQL Server instances that send malicious responses to client applications
• ODBC/OLE DB connection strings pointing at rogue endpoints through DNS or routing tampering

No authentication is required on the SQL Server side because the malicious response is delivered during the connection or query phase. See the Microsoft CVE-2024-29046 Advisory for the vendor's technical summary.

Detection Methods for CVE-2024-29046

Indicators of Compromise

• Outbound TDS connections (TCP/1433 or custom ports) from workstations or application servers to unexpected external or non-corporate IP addresses.
• Unusual child processes spawned by applications hosting msoledbsql.dll, such as command shells or script interpreters launched from database client processes.
• Crash events referencing msoledbsql.dll or heap corruption exceptions in Windows Error Reporting and Application event logs.

Detection Strategies

• Inspect loaded modules across endpoints to inventory applications importing msoledbsql.dll and identify outdated driver versions.
• Hunt for process lineage anomalies where database-connecting processes spawn cmd.exe, powershell.exe, or rundll32.exe.
• Correlate TDS network telemetry with endpoint process telemetry to flag connections to non-approved SQL Server destinations.

Monitoring Recommendations

• Enable PowerShell and process creation auditing (Event ID 4688) on systems running database client applications.
• Forward DNS query logs to detect resolution of unexpected SQL Server hostnames preceding outbound TDS traffic.
• Track driver file versions through software inventory tooling and alert when versions predate the April 2024 Patch Tuesday update.

How to Mitigate CVE-2024-29046

Immediate Actions Required

• Apply the April 2024 Microsoft security update for the OLE DB Driver for SQL Server and for SQL Server 2019 and SQL Server 2022 on all affected hosts.
• Update redistributable copies of msoledbsql.dll bundled with third-party applications and verify that application installers ship the patched driver.
• Restrict outbound TCP/1433 and custom SQL ports to approved internal database servers using host and network firewalls.

Patch Information

Microsoft released fixed versions of the OLE DB Driver for SQL Server alongside cumulative updates for SQL Server 2019 and SQL Server 2022. Administrators should consult the Microsoft CVE-2024-29046 Advisory for the specific build numbers and download locations. Deploy patches to both server instances and any client systems where the OLE DB driver is independently installed.

Workarounds

• Block outbound SQL Server connections to untrusted networks at the perimeter and on host firewalls until patches are deployed.
• Audit application connection strings and remove any that resolve hostnames to external or attacker-influenced DNS records.
• Where feasible, migrate applications to the Microsoft ODBC Driver for SQL Server or other supported providers while validating that those components are also fully patched.

# Verify installed OLE DB Driver version on Windows hosts
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\MSOLEDBSQL" |
  Select-Object InstalledVersion, InstallType

# Block outbound TDS to non-approved destinations (example)
New-NetFirewallRule -DisplayName "Block-Outbound-SQL-Untrusted" `
  -Direction Outbound -Protocol TCP -RemotePort 1433 `
  -RemoteAddress Internet -Action Block