CVE-2024-37318: SQL Server 2016 RCE Vulnerability

CVE-2024-37318 Overview

CVE-2024-37318 is a remote code execution vulnerability in the Microsoft SQL Server Native Client OLE DB Provider. The flaw is classified as a heap-based buffer overflow [CWE-122] and affects multiple supported SQL Server releases. An attacker can trigger arbitrary code execution by convincing a victim to connect to a malicious SQL Server instance. Microsoft addressed the issue in the July 2024 Patch Tuesday security update.

Critical Impact
Successful exploitation grants the attacker remote code execution in the context of the targeted client process, leading to full compromise of confidentiality, integrity, and availability of the affected host.

Affected Products

Microsoft SQL Server 2016
Microsoft SQL Server 2017
Microsoft SQL Server 2019
Microsoft SQL Server 2022

Discovery Timeline

2024-07-09 - CVE-2024-37318 published to the National Vulnerability Database
2024-07-09 - Microsoft releases security update addressing the vulnerability
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37318

Vulnerability Analysis

The vulnerability resides in the SQL Server Native Client OLE DB Provider (SQLNCLI / MSOLEDBSQL), the client-side library used by applications to communicate with SQL Server. The component contains a heap-based buffer overflow [CWE-122] reachable through specially crafted server responses. When a client connects to a malicious or attacker-controlled SQL Server endpoint, the server can return data that exceeds the bounds of a heap-allocated buffer in the provider.

The overflow corrupts adjacent heap structures and enables an attacker to overwrite control data used by the client process. With reliable heap grooming, this corruption can be turned into arbitrary code execution within the process loading the OLE DB provider. The flaw carries network attack reach, low complexity, and requires user interaction such as initiating an outbound connection.

Root Cause

The root cause is improper validation of length fields and data structures returned by the remote SQL Server during the OLE DB connection and result-set handling routines. The provider allocates a fixed-size heap buffer based on assumptions about server-provided metadata. A malicious server can supply oversized or malformed values that bypass these length checks, producing an out-of-bounds write on the heap.

Attack Vector

Exploitation requires a client application using the SQL Server Native Client OLE DB Provider to connect to an attacker-controlled SQL Server. Attackers commonly achieve this through phishing links, malicious Office documents containing data connections, ODBC/OLE DB configuration files, or coerced authentication that redirects clients to a rogue endpoint. The vulnerability does not require prior authentication to the attacker's server.

No public proof-of-concept code has been published for CVE-2024-37318. Refer to the Microsoft Security Update Guide for CVE-2024-37318 for vendor technical details.

Detection Methods for CVE-2024-37318

Indicators of Compromise

Outbound TCP connections from end-user workstations or application servers to untrusted SQL Server endpoints on port 1433 or dynamic SQL ports.
Unexpected crashes or access violations in processes that load sqlncli11.dll, msoledbsql.dll, or msoledbsql19.dll.
Spawning of child processes such as cmd.exe, powershell.exe, or rundll32.exe from applications using OLE DB connectivity.

Detection Strategies

Monitor for processes loading the SQL Server Native Client OLE DB Provider libraries and correlate with subsequent suspicious child-process creation.
Inspect SQL Server client traffic for connections to external or non-corporate IP ranges, including connections initiated from Office applications or scripting hosts.
Hunt for memory corruption telemetry — Windows Error Reporting events and application crash dumps referencing the OLE DB provider DLLs.

Monitoring Recommendations

Enable Sysmon Event ID 7 (ImageLoad) for the affected DLLs and Event ID 1 (ProcessCreate) for child processes spawned by database client applications.
Alert on outbound SQL traffic crossing trust boundaries, especially from user endpoints rather than application servers.
Track installed versions of MSOLEDBSQL and SQL Server client tooling across the estate to identify unpatched hosts.

How to Mitigate CVE-2024-37318

Immediate Actions Required

Apply the July 2024 Microsoft security updates to all affected SQL Server 2016, 2017, 2019, and 2022 installations.
Update client systems running the standalone MSOLEDBSQL redistributable to the patched version listed in the Microsoft advisory.
Inventory applications that link against the SQL Server Native Client OLE DB Provider and prioritize patching those hosts.

Patch Information

Microsoft released cumulative updates and standalone driver updates addressing CVE-2024-37318 on July 9, 2024. Administrators should consult the Microsoft Security Update Guide for CVE-2024-37318 for the specific KB articles and build numbers that correspond to each supported SQL Server major version and client driver release.

Workarounds

Restrict outbound TCP 1433 and SQL Browser UDP 1434 traffic from user workstations to only approved internal SQL Server hosts using host or perimeter firewalls.
Block execution of untrusted .udl, .odc, and Office documents containing embedded data connection strings sourced from email or the web.
Where feasible, migrate applications from the legacy SQL Server Native Client to the supported Microsoft OLE DB Driver for SQL Server and keep it current.

bash

# Configuration example: Windows Firewall rule restricting outbound SQL client traffic
New-NetFirewallRule -DisplayName "Block Outbound SQL to Untrusted Hosts" `
  -Direction Outbound `
  -Protocol TCP `
  -RemotePort 1433 `
  -RemoteAddress Internet `
  -Action Block `
  -Profile Any