CVE-2024-29048: Microsoft OLE DB Driver for SQL RCE

CVE-2024-29048 Overview

CVE-2024-29048 is a remote code execution vulnerability in the Microsoft OLE DB Driver for SQL Server. The flaw stems from a heap-based buffer overflow [CWE-122] in the client-side driver component. An attacker who controls a malicious SQL Server can trigger the vulnerability when a client application connects to it using the affected driver.

Successful exploitation requires user interaction, which Microsoft describes as a user being tricked into connecting to an attacker-controlled SQL Server instance. Exploitation results in code execution in the context of the client process. The vulnerability carries a CVSS 3.1 score of 8.8 and affects Microsoft SQL Server 2019, SQL Server 2022, and the standalone OLE DB Driver for SQL Server.

Critical Impact

Attackers can execute arbitrary code on client systems that connect to a malicious SQL Server using a vulnerable OLE DB driver, resulting in full compromise of confidentiality, integrity, and availability.

Affected Products

• Microsoft OLE DB Driver for SQL Server
• Microsoft SQL Server 2019 (x64)
• Microsoft SQL Server 2022 (x64)

Discovery Timeline

• 2024-04-09 - CVE-2024-29048 published to NVD as part of Microsoft's April 2024 Patch Tuesday
• 2025-01-15 - Last updated in NVD database

Technical Details for CVE-2024-29048

Vulnerability Analysis

The vulnerability resides in the Microsoft OLE DB Driver for SQL Server, a client-side data access component used by applications to communicate with SQL Server instances. The driver mishandles data returned from a SQL Server during connection or query processing. A specially crafted server response causes a heap-based buffer overflow [CWE-122] inside the client process.

Because the attack vector is network-based and the driver runs inside whatever application initiated the connection, exploitation can yield code execution in that application's security context. This includes business applications, integration services, and SQL Server itself when it acts as a linked-server client. The Exploit Prediction Scoring System (EPSS) places this issue in the 84th percentile, reflecting elevated interest relative to most CVEs even though no public proof of concept is currently available.

Root Cause

The root cause is improper validation of length or size fields in data structures returned by a SQL Server peer. When the driver allocates a heap buffer based on expected response sizes and then copies attacker-controlled data without enforcing bounds, adjacent heap metadata and objects are corrupted. Attackers can shape the heap to convert the overflow into a controlled write, leading to arbitrary code execution.

Attack Vector

Exploitation requires the victim client to initiate a connection to an attacker-controlled SQL Server endpoint. Common scenarios include phishing links that launch a database client, malicious connection strings embedded in shared files, or compromised internal services that are redirected to a rogue server. Once the connection handshake or initial query response is processed, the malicious server delivers a crafted Tabular Data Stream (TDS) payload that overflows the driver's heap buffer.

No public exploit code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Update CVE-2024-29048 advisory for technical details.

Detection Methods for CVE-2024-29048

Indicators of Compromise

• Unexpected outbound TDS traffic (TCP/1433 or custom SQL ports) from workstations or application servers to untrusted external IP addresses.
• Crashes or unusual memory faults in processes loading msoledbsql.dll or sqlncli.dll.
• Child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned by applications that normally only perform SQL queries.
• Connection strings or ODBC data source entries pointing to unfamiliar hostnames discovered in recently opened documents.

Detection Strategies

• Inspect EDR telemetry for module loads of msoledbsql.dll followed by anomalous process behavior such as code injection or new persistence entries.
• Hunt for SQL client applications (sqlcmd.exe, Excel.exe, Power BI, custom .NET apps) initiating outbound connections to non-corporate SQL endpoints.
• Correlate Windows Error Reporting (WER) events and application crash dumps referencing OLE DB Driver modules across the fleet.

Monitoring Recommendations

• Enable command-line and module-load logging via Sysmon Event IDs 1 and 7 to track invocation of OLE DB client processes.
• Forward network flow data to your SIEM and alert on TDS traffic crossing trust boundaries.
• Maintain an inventory of installed msoledbsql versions across endpoints and servers to confirm patch coverage.

How to Mitigate CVE-2024-29048

Immediate Actions Required

• Apply the April 2024 Microsoft security updates for SQL Server 2019, SQL Server 2022, and the standalone Microsoft OLE DB Driver for SQL Server.
• Inventory all systems with msoledbsql.dll installed, including application servers, developer workstations, and reporting tools, then prioritize patching.
• Restrict outbound TCP/1433 and other SQL Server ports at the perimeter so internal clients cannot connect to arbitrary external SQL servers.
• Educate users not to open connection files (.udl, .odc, .rdp-embedded data sources) received from untrusted sources.

Patch Information

Microsoft released fixed versions of the OLE DB Driver for SQL Server and cumulative updates for SQL Server 2019 and SQL Server 2022 as part of the April 2024 security release. Update package details and version numbers are listed in the Microsoft Security Update CVE-2024-29048 advisory. Both the redistributable MSOLEDBSQL driver and the in-box SQL Server client components must be updated, as patching only the server does not remediate client-side exposure.

Workarounds

• Where patching is delayed, block outbound SQL Server protocol traffic from endpoints that do not require external database connectivity.
• Use application allowlisting to prevent untrusted executables from loading the OLE DB driver until updates are deployed.
• Configure host firewalls to permit SQL client connections only to approved internal SQL Server instances.

# Configuration example: confirm installed MSOLEDBSQL driver version on Windows
powershell -Command "Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\MSOLEDBSQL' | Select-Object InstalledVersion"

# Block outbound TDS traffic to untrusted networks (example using Windows Firewall)
netsh advfirewall firewall add rule name="Block-Outbound-TDS" dir=out action=block protocol=TCP remoteport=1433 remoteip=Any