Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-21353: Microsoft WDAC ODBC Driver allows remote code execution

CVE-2024-21353 · published 2 years ago

Summary

The Microsoft WDAC ODBC Driver is affected. If exploited, this vulnerability could allow an attacker to run malicious code on a system without permission. To protect your systems, ensure you have the latest security updates installed and follow Microsoft's recommended security guidelines.

What to do

Update microsoft windows server 2022, 23h2 edition (server core installation) to version 10.0.25398.709 or later.
Update microsoft windows_server_2022_23h2 to version 10.0.25398.709 or later.

Affected software

Vendor	Product	Affected versions
microsoft	windows server 2022, 23h2 edition (server core installation)	< 10.0.25398.709
microsoft	windows_server_2022_23h2	< 10.0.25398.709 `cpe:2.3:o:microsoft:windows_server_2022_23h2::::::::`

Original advisory text

Microsoft WDAC ODBC Driver Remote Code Execution Vulnerability

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21353 Patch Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

2% chance of attack within 30 days

Type

CWE-122Heap-based Buffer Overflow

Timeline

Published13 Feb 2024

Updated3 Nov 2026

First seen10 Aug 2026

Sources

CVE-2024-21353 · NVD

CVE-2024-21353 · MITRE

Track software like this

Free during beta