CVE-2026-72933: Microsoft WDAC OLE DB Buffer Overflow Flaw

CVE-2026-72933 Overview

CVE-2026-72933 is a heap-based buffer overflow [CWE-122] in the Microsoft Windows Data Access Components (WDAC) Object Linking and Embedding Database (OLE DB) provider for SQL. The flaw allows an unauthorized attacker to execute arbitrary code over a network when a user interacts with a crafted resource. Microsoft published the advisory on September 8, 2026, tracking the issue through the MSRC Update Guide.

Critical Impact
Successful exploitation grants remote code execution in the context of the affected client process, enabling full compromise of confidentiality, integrity, and availability.

Affected Products

Microsoft Windows Data Access Components (WDAC)
Microsoft OLE DB provider for SQL Server
Windows systems consuming SQL data through the affected WDAC OLE DB provider

Discovery Timeline

2026-09-08 - CVE CVE-2026-72933 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72933

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in the WDAC OLE DB provider for SQL. The provider mishandles memory allocation or bounds checks when parsing data returned from a SQL data source. An attacker who controls the response from a malicious SQL endpoint can overflow a heap buffer inside the client process.

Because the flaw resides in a client-side data access component, exploitation requires user interaction. A victim must connect to or query a malicious SQL server, typically by opening a crafted file, link, or application that initiates the connection. Successful exploitation yields code execution in the context of the calling process.

Microsoft classifies the issue under CWE-122, Heap-based Buffer Overflow. Full technical details are available in the Microsoft CVE-2026-72933 Update Guide.

Root Cause

The root cause is improper validation of the length of attacker-controlled fields returned from a SQL server response. The provider writes data into a fixed-size heap buffer without enforcing size constraints, corrupting adjacent heap metadata or object pointers. This corruption is leveraged to hijack control flow.

Attack Vector

The attack vector is network-based with low complexity and no privileges required, but user interaction is required. An attacker hosts a malicious SQL server and lures a victim into connecting through any application that uses the WDAC OLE DB provider. Common triggers include Excel data imports, ODBC-linked Office documents, and custom line-of-business applications.

No verified proof-of-concept code is publicly available. Refer to the vendor advisory for exploitation prerequisites.

Detection Methods for CVE-2026-72933

Indicators of Compromise

Unexpected outbound TCP connections from Office or line-of-business applications to untrusted hosts on port 1433 or dynamic SQL ports.
Crash dumps or Windows Error Reporting events referencing msolap.dll, msdasql.dll, or sqloledb.dll with heap corruption exceptions such as 0xC0000374.
Unusual child processes spawned by excel.exe, winword.exe, or other OLE DB consumers immediately after opening an external data source.

Detection Strategies

Hunt for process creation events where OLE DB consumer applications spawn shells, script interpreters, or rundll32.exe.
Correlate SQL client connections to rare or newly observed external IP addresses with subsequent process anomalies on the initiating host.
Deploy YARA or behavioral rules that flag heap corruption patterns and exploitation primitives inside WDAC provider DLLs.

Monitoring Recommendations

Enable Windows Defender Exploit Guard and Attack Surface Reduction rules that block Office applications from creating child processes.
Forward Sysmon Event ID 1, 3, and 11 telemetry to a central data lake to correlate outbound SQL traffic with process and file activity.
Track patch compliance for the September 2026 Microsoft security rollup across all Windows endpoints and servers.

How to Mitigate CVE-2026-72933

Immediate Actions Required

Apply the September 2026 Microsoft security update that addresses CVE-2026-72933 on all Windows systems with the WDAC OLE DB provider installed.
Restrict outbound traffic on SQL Server ports (TCP 1433 and dynamic ports) to only approved database hosts.
Educate users to avoid opening spreadsheets, documents, or database connection files from untrusted sources.

Patch Information

Microsoft has released a security update for CVE-2026-72933. Consult the Microsoft CVE-2026-72933 Update Guide for the specific Knowledge Base article, affected Windows versions, and download links. Install the update through Windows Update, WSUS, Microsoft Update Catalog, or your enterprise patch management platform.

Workarounds

Block outbound connections to untrusted SQL servers at the network perimeter and host firewall until patches are deployed.
Disable or restrict the use of external data connections in Office applications through Group Policy.
Apply the principle of least privilege so that users running OLE DB clients operate without administrative rights.

bash

# Example Group Policy setting to block Office from creating child processes
# Attack Surface Reduction rule GUID (Windows Defender)
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled