Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2023-21798: Microsoft ODBC Driver Remote Code Execution Risk
CVE-2023-21798 · published 3 years ago
Summary
A remote attacker can execute malicious code on your server using the Microsoft ODBC Driver. This is a concern because it could allow unauthorized access to your system. To protect yourself, update the Microsoft ODBC Driver to the latest version as soon as possible.
What to do
- Update microsoft windows 10 version 1507 to version 10.0.10240.19747 or later.
- Update microsoft windows 10 version 1607 to version 10.0.14393.5717 or later.
- Update microsoft windows 10 version 1809 to version 10.0.17763.4010 or later.
- Update microsoft windows 10 version 20h2 to version 10.0.19042.2604 or later.
- Update microsoft windows 10 version 21h2 to version 10.0.19044.2604 or later.
- Update microsoft windows 10 version 22h2 to version 10.0.19045.2604 or later.
- Update microsoft windows 11 version 21h2 to version 10.0.22621.1574 or later.
- Update microsoft windows 11 version 22h2 to version 10.0.22621.1265 or later.
- Update microsoft windows server 2008 service pack 2 to version 6.0.6003.21915 or later.
- Update microsoft windows server 2008 r2 service pack 1 to version 6.1.7601.26366 or later.
- Update microsoft windows server 2008 r2 service pack 1 (server core installation) to version 6.1.7601.26366 or later.
- Update microsoft windows server 2008 service pack 2 to version 6.0.6003.21915 or later.
- Update microsoft windows server 2008 service pack 2 (server core installation) to version 6.0.6003.21915 or later.
- Update microsoft windows server 2012 to version 6.2.9200.24116 or later.
- Update microsoft windows server 2012 (server core installation) to version 6.2.9200.24116 or later.
- Update microsoft windows server 2012 r2 to version 6.3.9600.20821 or later.
- Update microsoft windows server 2012 r2 (server core installation) to version 6.3.9600.20821 or later.
- Update microsoft windows server 2016 to version 10.0.14393.5717 or later.
- Update microsoft windows server 2016 (server core installation) to version 10.0.14393.5717 or later.
- Update microsoft windows server 2019 to version 10.0.17763.4010 or later.
- Update microsoft windows server 2019 (server core installation) to version 10.0.17763.4010 or later.
- Update microsoft windows server 2022 to version 10.0.20348.1547 or later.
- Update microsoft windows_10_1507 to version 10.0.10240.19747 or later.
- Update microsoft windows_10_1607 to version 10.0.14393.5717 or later.
- Update microsoft windows_10_1809 to version 10.0.17763.4010 or later.
- Update microsoft windows_10_20h2 to version 10.0.19042.2604 or later.
- Update microsoft windows_10_21h2 to version 10.0.19044.2604 or later.
- Update microsoft windows_10_22h2 to version 10.0.19045.2604 or later.
- Update microsoft windows_11_21h2 to version 10.0.22000.1574 or later.
- Update microsoft windows_11_22h2 to version 10.0.22621.1265 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | windows 10 version 1507 | < 10.0.10240.19747 |
| microsoft | windows 10 version 1607 | < 10.0.14393.5717 |
| microsoft | windows 10 version 1809 | < 10.0.17763.4010 |
| microsoft | windows 10 version 20h2 | < 10.0.19042.2604 |
| microsoft | windows 10 version 21h2 | < 10.0.19044.2604 |
| microsoft | windows 10 version 22h2 | < 10.0.19045.2604 |
| microsoft | windows 11 version 21h2 | < 10.0.22621.1574 |
| microsoft | windows 11 version 22h2 | < 10.0.22621.1265 |
| microsoft | windows server 2008 service pack 2 | < 6.0.6003.21915 |
| microsoft | windows server 2008 r2 service pack 1 | < 6.1.7601.26366 |
| microsoft | windows server 2008 r2 service pack 1 (server core installation) | < 6.1.7601.26366 |
| microsoft | windows server 2008 service pack 2 | < 6.0.6003.21915 |
| microsoft | windows server 2008 service pack 2 (server core installation) | < 6.0.6003.21915 |
| microsoft | windows server 2012 | < 6.2.9200.24116 |
| microsoft | windows server 2012 (server core installation) | < 6.2.9200.24116 |
| microsoft | windows server 2012 r2 | < 6.3.9600.20821 |
| microsoft | windows server 2012 r2 (server core installation) | < 6.3.9600.20821 |
| microsoft | windows server 2016 | < 10.0.14393.5717 |
| microsoft | windows server 2016 (server core installation) | < 10.0.14393.5717 |
| microsoft | windows server 2019 | < 10.0.17763.4010 |
| microsoft | windows server 2019 (server core installation) | < 10.0.17763.4010 |
| microsoft | windows server 2022 | < 10.0.20348.1547 |
| microsoft | windows_10_1507 |
< 10.0.10240.19747 cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:* |
| microsoft | windows_10_1607 |
< 10.0.14393.5717 cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:* |
| microsoft | windows_10_1809 |
< 10.0.17763.4010 cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:* |
| microsoft | windows_10_20h2 |
< 10.0.19042.2604 cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:arm64:* |
| microsoft | windows_10_21h2 |
< 10.0.19044.2604 cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:* |
| microsoft | windows_10_22h2 |
< 10.0.19045.2604 cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:* |
| microsoft | windows_11_21h2 |
< 10.0.22000.1574 cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:arm64:* |
| microsoft | windows_11_22h2 |
< 10.0.22621.1265 cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:arm64:* |
| microsoft | windows_server_2008 |
r2 cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:* |
| microsoft | windows_server_2012 |
r2 cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* |
| microsoft | windows_server_2016 |
All versions
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* |
| microsoft | windows_server_2019 |
All versions
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* |
| microsoft | windows_server_2022 |
All versions
cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:* |
Original advisory text
Microsoft ODBC Driver Remote Code Execution Vulnerability
Microsoft ODBC Driver Remote Code Execution Vulnerability
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21798 Patch Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-125Out-of-bounds Read
Timeline
Published14 Feb 2023
Updated4 Nov 2026
First seen19 Aug 2026
Track software like this
Free during beta