CVE-2024-29982: OLE DB Driver for SQL Server RCE Flaw

CVE-2024-29982 Overview

CVE-2024-29982 is a remote code execution vulnerability in the Microsoft OLE DB Driver for SQL Server. The flaw is classified as a heap-based buffer overflow [CWE-122] and affects client systems that connect to attacker-controlled SQL Server instances. An attacker can trick a user into connecting to a malicious server, triggering memory corruption in the OLE DB Driver process and executing arbitrary code in the context of the connecting application.

Critical Impact
Successful exploitation results in remote code execution on the client host with the privileges of the application using the OLE DB Driver, enabling full compromise of confidentiality, integrity, and availability.

Affected Products

Microsoft OLE DB Driver for SQL Server
Microsoft SQL Server 2019 (x64)
Microsoft SQL Server 2022 (x64)

Discovery Timeline

2024-04-09 - CVE-2024-29982 published to NVD and addressed in Microsoft's April 2024 security update
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29982

Vulnerability Analysis

The vulnerability resides in the Microsoft OLE DB Driver for SQL Server, the client-side data access component used by applications to communicate with SQL Server instances over the Tabular Data Stream (TDS) protocol. The driver mishandles data returned from a SQL Server during connection or query processing, leading to a heap-based buffer overflow inside the driver's address space.

Because the driver is loaded by the calling application, code execution occurs in that application's process context. This can include sqlcmd, custom .NET or C++ database clients, BI tools, or services that maintain persistent SQL connections. The attack requires user interaction: the victim must initiate a connection to an attacker-controlled SQL Server endpoint.

The EPSS score of 2.4% (81st percentile) places this issue among the higher-likelihood exploitation candidates for an unpatched client library, though no public proof-of-concept or in-the-wild exploitation has been confirmed.

Root Cause

The defect is a heap-based buffer overflow [CWE-122] in the OLE DB Driver's parsing of server-supplied TDS protocol data. Insufficient bounds checking on size fields received from the server allows attacker-controlled data to overwrite adjacent heap memory, corrupting metadata or function pointers used during deserialization of result sets.

Attack Vector

The attacker hosts a malicious SQL Server endpoint and lures an authenticated or unauthenticated user into establishing a connection. This is typically achieved through phishing links containing UDL files, ODBC connection strings, or applications configured to query a hostile server. Once the client connects, the rogue server returns crafted TDS packets that trigger the overflow inside the OLE DB Driver, yielding code execution on the client host. No privileges are required on the target system, only that the victim initiates the outbound database connection.

No verified public exploit code is available. Refer to the Microsoft Security Update CVE-2024-29982 for vendor technical details.

Detection Methods for CVE-2024-29982

Indicators of Compromise

Outbound TDS connections (TCP/1433 or dynamic SQL Server ports) from workstations or application servers to untrusted external IP addresses.
Unexpected child processes spawned by applications hosting msoledbsql.dll or sqlncli.dll.
Crashes or access violations originating in msoledbsql.dll recorded in Windows Error Reporting (WER) or Application event logs.
Loading of the OLE DB Driver by processes that do not typically perform database access (e.g., browsers, Office applications).

Detection Strategies

Hunt for SQL client processes (such as sqlcmd.exe, excel.exe, custom services) initiating connections to non-corporate IP ranges on SQL Server ports.
Inspect endpoint telemetry for memory corruption indicators in modules matching msoledbsql*.dll and correlate with subsequent process creation events.
Use EDR behavioral rules to flag database client processes that spawn cmd.exe, powershell.exe, or rundll32.exe shortly after a connection event.

Monitoring Recommendations

Inventory hosts where the OLE DB Driver is installed and track the file version of msoledbsql.dll against Microsoft's patched build.
Enable Microsoft Defender Attack Surface Reduction rules that block Office and script hosts from launching child processes following database operations.
Monitor egress firewall logs for outbound 1433/TCP traffic and alert on connections to destinations outside the approved database server allowlist.

How to Mitigate CVE-2024-29982

Immediate Actions Required

Apply the April 2024 security update for the Microsoft OLE DB Driver for SQL Server on all affected client and server systems.
Update SQL Server 2019 and SQL Server 2022 instances to the cumulative update levels listed in the Microsoft Security Response Center advisory.
Block outbound TCP/1433 and SQL Browser (UDP/1434) traffic from user workstations to untrusted networks at the perimeter firewall.
Audit installed versions of msoledbsql.dll across the estate and prioritize remediation on hosts that connect to external databases.

Patch Information

Microsoft released fixed builds of the OLE DB Driver for SQL Server (versions 18.x and 19.x) and corresponding SQL Server 2019 and 2022 cumulative updates. Refer to the Microsoft Security Update CVE-2024-29982 advisory for the exact KB articles, MSI packages, and version strings that contain the fix.

Workarounds

Restrict applications to connect only to approved internal SQL Server endpoints using application allowlisting or host-based firewall rules.
Disable or remove the OLE DB Driver on systems that do not require SQL Server connectivity, falling back to managed providers where feasible.
Train users to reject unsolicited database connection prompts, .udl files, and connection strings received through email or messaging.

bash

# Verify installed OLE DB Driver version on Windows hosts
powershell -Command "Get-Item 'C:\Program Files\Common Files\System\OLE DB\msoledbsql.dll' | Select-Object -ExpandProperty VersionInfo"

# Block outbound SQL traffic from a workstation to untrusted destinations
New-NetFirewallRule -DisplayName "Block Outbound TDS" -Direction Outbound `
  -Protocol TCP -RemotePort 1433 -RemoteAddress Internet -Action Block