CVE-2024-35256: SQL Server 2016 RCE Vulnerability

CVE-2024-35256 Overview

CVE-2024-35256 is a remote code execution vulnerability in the Microsoft SQL Server Native Client OLE DB Provider. The flaw is classified as a heap-based buffer overflow [CWE-122] affecting multiple supported SQL Server releases. An attacker can exploit the vulnerability over a network when a victim connects to a malicious database server or processes attacker-controlled OLE DB data. Successful exploitation leads to arbitrary code execution in the context of the client process. Microsoft addressed the issue in the July 2024 Patch Tuesday cycle.

Critical Impact
Successful exploitation grants attackers arbitrary code execution on the targeted host, compromising the confidentiality, integrity, and availability of the affected SQL Server client environment.

Affected Products

Microsoft SQL Server 2016
Microsoft SQL Server 2017
Microsoft SQL Server 2019
Microsoft SQL Server 2022

Discovery Timeline

2024-07-09 - CVE-2024-35256 published to NVD and Microsoft releases security patch
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35256

Vulnerability Analysis

The vulnerability resides in the SQL Server Native Client OLE DB Provider, a component used by client applications to communicate with SQL Server instances. The provider mishandles memory allocations when parsing server responses, producing a heap-based buffer overflow condition [CWE-122]. An attacker who controls the server side of the connection can return crafted Tabular Data Stream (TDS) responses that overflow heap structures used by the client. The overflow corrupts adjacent heap metadata or object pointers, providing a path to arbitrary code execution in the client process. Exploitation requires user interaction, typically a user opening a connection to an attacker-controlled SQL Server endpoint or processing a malicious data source. The Exploit Prediction Scoring System (EPSS) rates the probability of exploitation at 1.554% (72nd percentile), reflecting moderate interest in client-side database attack surface.

Root Cause

The root cause is improper validation of length or size fields within data structures returned by a SQL Server endpoint. The OLE DB Provider trusts attacker-controlled values when sizing heap buffers, allowing oversized payloads to write beyond allocated boundaries. This is a classic heap corruption pattern affecting native code in the OLE DB client stack.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a malicious SQL Server instance, or compromises an existing one, and lures a victim into connecting from a vulnerable client. Once the client establishes a session, the malicious server returns crafted protocol responses that trigger the heap overflow. Common vectors include phishing links to .udl files, malicious database connection strings embedded in documents, or applications that auto-connect to attacker-controlled hosts. Refer to the Microsoft CVE-2024-35256 Advisory for additional technical context.

Detection Methods for CVE-2024-35256

Indicators of Compromise

Outbound TDS connections (TCP/1433 or custom ports) from workstations or servers to unexpected external hosts.
Crashes or unexpected termination of processes hosting the SQL Server Native Client, such as sqlncli11.dll or msoledbsql.dll.
Spawning of cmd.exe, powershell.exe, or other LOLBins as child processes of applications loading the OLE DB Provider.
Suspicious .udl files or connection strings referencing unfamiliar SQL Server endpoints.

Detection Strategies

Inventory hosts loading msoledbsql.dll or sqlncli11.dll and correlate with patch status against the July 2024 Microsoft updates.
Hunt for anomalous process trees where Office, browser, or scripting hosts establish TDS sessions to external IPs.
Monitor Windows Error Reporting (WER) and crash dumps referencing the OLE DB Provider modules for signs of exploitation attempts.

Monitoring Recommendations

Alert on connections from client subnets to SQL Server ports on non-corporate IP ranges.
Track creation of child processes by applications that embed the SQL Server Native Client, particularly when the child process is an interpreter or shell.
Forward endpoint and network telemetry to a centralized analytics platform to correlate client-side crashes with outbound database traffic.

How to Mitigate CVE-2024-35256

Immediate Actions Required

Apply the July 2024 Microsoft security updates to all SQL Server 2016, 2017, 2019, and 2022 installations and to any standalone deployments of the SQL Server Native Client or msoledbsql driver.
Identify and inventory every endpoint and application that ships or relies on the OLE DB Provider, including third-party software with bundled drivers.
Restrict outbound TDS traffic at the network perimeter to known internal SQL Server hosts.

Patch Information

Microsoft released fixes for CVE-2024-35256 on 2024-07-09. Administrators should consult the Microsoft CVE-2024-35256 Advisory for the cumulative update, GDR, or driver package that matches their deployment. Patches are available for all listed SQL Server versions and for the standalone Microsoft OLE DB Driver for SQL Server.

Workarounds

Block outbound connections to untrusted SQL Server endpoints using host-based or perimeter firewalls when patching cannot be performed immediately.
Train users to avoid opening .udl, .odc, or document-embedded data connections originating from untrusted sources.
Where feasible, remove or disable the SQL Server Native Client and migrate applications to a patched driver version.

bash

# Verify installed Microsoft OLE DB Driver version on Windows
reg query "HKLM\SOFTWARE\Microsoft\MSSQLServer\Client\SNI11.0" /s
wmic datafile where name="C:\\Windows\\System32\\msoledbsql.dll" get Version

# Block outbound TDS to untrusted networks (example)
New-NetFirewallRule -DisplayName "Block external TDS 1433" -Direction Outbound -Protocol TCP -RemotePort 1433 -RemoteAddress Internet -Action Block