CVE-2024-48995: Microsoft SQL Server 2016 RCE Vulnerability

CVE-2024-48995 Overview

CVE-2024-48995 is a remote code execution vulnerability in the Microsoft SQL Server Native Client. The flaw is classified as a heap-based buffer overflow [CWE-122] and affects SQL Server 2016, 2017, and 2019 on x64 platforms. An attacker can execute arbitrary code on a vulnerable system by inducing a user to connect to a malicious server or process crafted response data.

Microsoft disclosed the vulnerability through its Security Update Guide on November 12, 2024. The issue carries a CVSS 3.1 base score of 8.8 and requires user interaction over the network. The EPSS probability is 2.234% at the 84.87 percentile, indicating elevated relative exploitation likelihood.

Critical Impact
Successful exploitation grants the attacker code execution in the security context of the user running the affected client, enabling full compromise of confidentiality, integrity, and availability.

Affected Products

Microsoft SQL Server 2016 (x64)
Microsoft SQL Server 2017 (x64)
Microsoft SQL Server 2019 (x64)

Discovery Timeline

2024-11-12 - CVE-2024-48995 published to NVD
2024-11-12 - Microsoft releases security update via the Microsoft Security Advisory
2024-11-15 - Last updated in NVD database

Technical Details for CVE-2024-48995

Vulnerability Analysis

The vulnerability resides in the SQL Server Native Client (SNAC), the client-side data access library used by applications to communicate with SQL Server using OLE DB and ODBC. The defect is a heap-based buffer overflow [CWE-122] triggered when the client parses malformed data returned from a server endpoint. When the client processes attacker-controlled response fields, an undersized heap allocation is overflowed by adjacent copy operations, corrupting heap metadata or adjacent objects.

Exploitation requires user interaction, meaning a victim must initiate a connection from a vulnerable client to an attacker-controlled or attacker-influenced SQL endpoint. Once the malicious response is processed, the attacker gains code execution within the process loading sqlncli11.dll or related SNAC components. The Scope is Unchanged, so code runs in the privilege context of the client application.

Root Cause

The root cause is improper validation of length fields or record boundaries when copying server-provided data into a heap buffer. The native client trusts size metadata from the response stream and writes payload bytes beyond the allocated region. This pattern aligns with classic heap corruption flaws affecting Tabular Data Stream (TDS) parsing in legacy SNAC code paths.

Attack Vector

The attack vector is network-based with low complexity and no privileges required. An attacker hosts a rogue SQL Server endpoint or performs a man-in-the-middle interception of TDS traffic. The attacker then induces a privileged user, application, or scheduled job to initiate an outbound connection. When the vulnerable client processes the crafted response packet, the heap overflow executes attacker-controlled code in-process. See the Microsoft Security Advisory for vendor technical details.

Detection Methods for CVE-2024-48995

Indicators of Compromise

Unexpected outbound TDS connections (TCP/1433 or dynamic ports) from workstations or application servers to untrusted external IP addresses.
Crash dumps or Windows Error Reporting events referencing sqlncli11.dll, sqlsrv32.dll, or msoledbsql.dll with heap corruption exception codes such as 0xC0000374.
New child processes (for example, cmd.exe, powershell.exe) spawned by processes that have loaded the SQL Server Native Client.
Unusual DNS resolutions or LDAP/SQL queries originating from BI tools, SSIS packages, or reporting services to non-corporate destinations.

Detection Strategies

Inventory hosts that load SNAC DLLs and correlate with installed SQL Server versions to identify unpatched systems.
Hunt for process executions where Office, scripting hosts, or business applications load sqlncli*.dll and subsequently spawn shell or LOLBin processes.
Inspect TDS traffic for anomalous packet sizes or oversized length-prefixed fields that deviate from baseline application behavior.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block child process creation from Office and scripting hosts to limit post-exploitation pivots.
Forward Sysmon Event IDs 1, 7, and 10 to a centralized log platform to capture module loads and process access against client applications using SNAC.
Alert on outbound SQL connections from user endpoints to addresses outside the approved database server inventory.

How to Mitigate CVE-2024-48995

Immediate Actions Required

Apply the November 2024 Microsoft security updates for SQL Server 2016, 2017, and 2019 listed in the Microsoft Security Advisory.
Identify all endpoints with the SQL Server Native Client installed, including third-party applications that bundle SNAC, and patch or remove them.
Restrict outbound TCP/1433 and TDS traffic from user workstations to an allowlist of approved internal SQL endpoints.
Audit linked servers, SSIS packages, and reporting services for connection strings that could be redirected to attacker-controlled hosts.

Patch Information

Microsoft addressed CVE-2024-48995 in the November 12, 2024 cumulative security updates for SQL Server 2016, 2017, and 2019. Administrators should consult the Microsoft Security Advisory for the specific KB articles, build numbers, and download links corresponding to each supported version and service pack level.

Workarounds

Uninstall the standalone SQL Server Native Client (deprecated by Microsoft) where modern drivers such as msodbcsql 17/18 or msoledbsql can be substituted.
Block outbound SQL traffic at the network perimeter to prevent clients from reaching untrusted external endpoints.
Enforce Windows Defender Application Control or AppLocker policies that prevent unauthorized applications from loading SNAC modules.

bash

# Identify hosts with the SQL Server Native Client installed (run via remote management)
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like '*SQL Server*Native Client*' } | Select-Object Name, Version, Vendor

# Block outbound TDS to non-approved destinations on Windows endpoints
New-NetFirewallRule -DisplayName 'Block-Outbound-TDS-1433' -Direction Outbound -Protocol TCP -RemotePort 1433 -RemoteAddress Any -Action Block