CVE-2026-42990: Windows 10 1607 RCE Vulnerability

CVE-2026-42990 Overview

CVE-2026-42990 is a heap-based buffer overflow [CWE-122] in the Microsoft SQL Server Open Database Connectivity (ODBC) driver. The flaw allows an unauthenticated attacker to execute arbitrary code over a network. The vulnerability affects the ODBC client component shipped with supported Windows client and server operating systems, spanning Windows 10, Windows 11, and Windows Server editions from 2012 through 2025.

Microsoft published the advisory on July 14, 2026, and the issue was rated critical based on network-reachable, unauthenticated code execution with high impact to confidentiality, integrity, and availability.

Critical Impact
An unauthenticated remote attacker can trigger memory corruption in the SQL Server ODBC driver and execute arbitrary code in the context of the vulnerable client process.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) across x86, x64, and ARM64
Microsoft Windows 11 (24H2, 25H2, 26H1) across x64 and ARM64
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-07-14 - CVE-2026-42990 published to the National Vulnerability Database
2026-07-14 - Microsoft publishes security update guidance for CVE-2026-42990
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-42990

Vulnerability Analysis

The vulnerability resides in the SQL Server ODBC driver, a client-side library that Windows applications use to communicate with SQL Server instances using Tabular Data Stream (TDS). A heap-based buffer overflow occurs when the driver processes attacker-controlled data received from a network endpoint acting as a SQL Server.

Because the overflow occurs on the heap, successful exploitation typically enables corruption of adjacent heap structures such as chunk metadata, C++ vtables, or function pointers. Attackers who control the corrupted memory can hijack execution flow and run code in the security context of the connecting application. Applications that automatically connect to remote data sources are particularly exposed.

The advisory classifies the attack vector as network with low complexity and no privileges or user interaction required, indicating the driver can be reached and coerced into parsing malicious server responses without prior authentication to the target host.

Root Cause

The root cause is improper validation of length or size fields governing a heap buffer within the ODBC driver's parsing routines [CWE-122]. When the driver copies server-supplied data into a fixed-size heap allocation without enforcing bounds, the copy operation writes past the end of the buffer and corrupts adjacent heap memory.

Attack Vector

Exploitation requires the victim to initiate an ODBC connection to a server controlled by the attacker, or for a legitimate connection path to be redirected via DNS spoofing, ARP poisoning, or a compromised intermediary. Once the client connects, the malicious server returns a crafted TDS response that triggers the overflow during response parsing. The current EPSS score is 0.659%, indicating limited observed exploitation activity in the short term while the flaw remains newly disclosed.

No public proof-of-concept exploit is available, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of publication.

Detection Methods for CVE-2026-42990

Indicators of Compromise

Unexpected crashes or Windows Error Reporting entries in processes that load sqlsrv32.dll, msodbcsql*.dll, or sqlncli*.dll
Outbound TDS traffic (default TCP/1433 or UDP/1434) from workstations or servers to untrusted or newly observed external destinations
Child process creation from applications that host ODBC clients, particularly shells such as cmd.exe or powershell.exe spawned from database-driven applications

Detection Strategies

Monitor for anomalous memory access violations and heap corruption exceptions in ODBC-consuming processes using endpoint telemetry
Alert on ODBC driver modules loading into non-database applications that establish outbound TDS connections to unusual destinations
Correlate crash telemetry with subsequent process injection, credential access, or lateral movement behaviors

Monitoring Recommendations

Enable Windows Defender Exploit Guard and Windows Error Reporting collection to centralize crash artifacts for triage
Log outbound connections on TCP/1433 and UDP/1434 at network egress points and baseline expected SQL Server destinations
Track deployment status of the Microsoft July 2026 security update across all Windows client and server assets

How to Mitigate CVE-2026-42990

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-42990 advisory to all affected Windows versions
Prioritize patching of systems that regularly initiate ODBC connections to external or untrusted networks
Inventory installed ODBC drivers (msodbcsql, sqlncli, sqlsrv32) and confirm patch coverage on both workstations and servers

Patch Information

Microsoft addressed CVE-2026-42990 through the July 2026 security update cycle. Patches are available through Windows Update and the Microsoft Update Catalog for all supported Windows 10, Windows 11, and Windows Server editions listed in the advisory. Administrators should consult the Microsoft Security Update CVE-2026-42990 guidance for KB article numbers specific to each operating system build.

Workarounds

Restrict outbound TCP/1433 and UDP/1434 traffic at perimeter and internal firewalls so ODBC clients cannot reach untrusted SQL Server endpoints
Enforce network segmentation between application hosts and database tiers to reduce the reachable attack surface for the driver
Where feasible, disable or uninstall unused ODBC drivers on endpoints that do not require SQL Server connectivity

bash

# Example: Windows Firewall rule to block outbound TDS traffic to non-approved destinations
New-NetFirewallRule -DisplayName "Block Outbound TDS to Untrusted" `
  -Direction Outbound `
  -Protocol TCP `
  -RemotePort 1433 `
  -RemoteAddress Internet `
  -Action Block