Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-48998: SQL Server Native Client allows hackers to run malicious code

CVE-2024-48998 · published 1 year ago

Summary

A vulnerability in the SQL Server Native Client could allow an attacker to execute unauthorized code on a server, potentially leading to data theft or system compromise. This affects any system using the SQL Server Native Client to connect to a database. To protect your system, apply the latest updates and ensure all connections are properly configured.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
microsoft	sql_server_2016	>= 13.0.6300.2, < 13.0.6455.2 >= 13.0.7000.253, < 13.0.7050.2 `cpe:2.3:a:microsoft:sql_server_2016:::::::x64:*`
microsoft	sql_server_2017	>= 14.0.1000.169, < 14.0.2070.1 >= 14.0.3006.16, < 14.0.3485.1 `cpe:2.3:a:microsoft:sql_server_2017:::::::x64:*`
microsoft	sql_server_2019	>= 15.0.2000.5, < 15.0.2130.3 >= 15.0.4003.23, < 15.0.4410.1 `cpe:2.3:a:microsoft:sql_server_2019:::::::x64:*`

Original advisory text

SQL Server Native Client Remote Code Execution Vulnerability

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-48998 Patch Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

1% chance of attack within 30 days

Type

CWE-122Heap-based Buffer Overflow

Timeline

Published12 Nov 2024

Updated31 Oct 2026

First seen7 Mar 2026

Sources

CVE-2024-48998 · NVD

Track software like this

Free during beta