SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

CVE-2024-37326

Summary

A remote code execution vulnerability exists in the SQL Server Native Client OLE DB Provider due to improper input validation. An attacker could exploit this vulnerability by sending specially crafted requests to an affected SQL Server instance, which could allow for arbitrary code execution in the context of the application using the OLE DB Provider. Successful exploitation may enable the attacker to create, modify, or delete data, install programs, or create new accounts with full user rights. Organizations using affected versions of the SQL Server Native Client should prioritize patching to mitigate this risk.

References