Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

CVE-2024-37318 · published 2 years ago
Summary

SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft sql_server_2016 < 13.0.6441.1
>= 13.0.7000.253, < 13.0.7037.1
cpe:2.3:a:microsoft:sql_server_2016:*:*:*:*:*:*:*:*
microsoft sql_server_2017 < 14.0.2056.2
>= 14.0.3456.2, < 14.0.3471.2
cpe:2.3:a:microsoft:sql_server_2017:*:*:*:*:*:*:*:*
microsoft sql_server_2019 < 15.0.2116.2
>= 15.0.4375.4, < 15.0.4382.1
cpe:2.3:a:microsoft:sql_server_2019:*:*:*:*:*:*:*:*
microsoft sql_server_2022 < 16.0.1121.4
>= 16.0.4125.3, < 16.0.4131.2
cpe:2.3:a:microsoft:sql_server_2022:*:*:*:*:*:*:*:*
Original advisory text
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
2% chance of attack within 30 days
Type
CWE-122Heap-based Buffer Overflow
Timeline
Published9 Jul 2024
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2024-37318 · NVD
Track software like this
Free during beta