CVE-2024-38088

CVE-2024-38088 is a remote code execution vulnerability in the SQL Server Native Client OLE DB Provider. It affects Microsoft SQL Server components and is rated CVSSv3.1 8.8 (High) with network attack vector and required user interaction. The issue is being addressed via July 2024 Microsoft secur...

CVE-2024-37336

CVE-2024-37336 affects SQL Server Native Client OLE DB Provider. It is a remote code execution vulnerability in the OLE DB client used by SQL Server, with base score 8.8 (HIGH). Microsoft released a security update (July 2024) to fix this and related CVEs; the update package for SQL Server 2016 S...

CVE-2024-38087

CVE-2024-38087 is a SQL Server Native Client OLE DB Provider Remote Code Execution vulnerability. Affected component: SQL Server Native Client OLE DB Provider (client and server interaction via the OLE DB driver). Root cause: vulnerability in the OLE DB Provider that can allow arbitrary code exec...

CVE-2024-37323

CVE-2024-37323 is a SQL Server Native Client OLE DB Provider Remote Code Execution vulnerability affecting SQL Server Native Client/OLE DB Provider usage. The CVSSv3.1 base score is 8.8 (HIGH); attack vector NETWORK, attack complexity LOW, privileges required NONE, user interaction REQUIRED, and ...

CVE-2024-21449

CVE-2024-21449 is a vulnerability in the Microsoft SQL Server Native Client OLE DB Provider that enables remote code execution. Affected component: SQL Server Native Client OLE DB Provider (client/driver) used by SQL Server and clients. Root cause: improper handling of data returned by the provid...

CVE-2024-35272

CVE-2024-35272 is a SQL Server Native Client OLE DB Provider remote code execution vulnerability. The NCSC advisory and Microsoft KB update confirm the issue affects Windows SQL Server components and was fixed by July 9, 2024 security updates (KB5040944). The vulnerability allows code execution i...

CVE-2024-37319

CVE-2024-37319 is a Microsoft SQL Server Native Client OLE DB Provider Remote Code Execution vulnerability. The advisory data confirms the flaw affects the SQL Server Native Client OLE DB Provider, with a CVSS v3.1 base score of 8.8 (High). Attack vector is NETWORK; exploitation requires user int...

CVE-2024-37328

CVE-2024-37328 is a remote code execution vulnerability in the SQL Server Native Client OLE DB Provider. CVSSv3.1 base score 8.8 (HIGH) with Network attack vector and user interaction required, implying exploitation via a crafted data response when the client driver is used to connect to a SQL Se...

CVE-2024-37318

CVE-2024-37318 is a Remote Code Execution vulnerability in the SQL Server Native Client OLE DB Provider. The CVSSv3.1 base score is 8.8 (HIGH). Attack vector: NETWORK; Attack complexity: LOW; Privileges required: NONE; User interaction: REQUIRED; Impact on confidentiality, integrity, and availabi...

CVE-2024-37332

CVE-2024-37332 is a Remote Code Execution vulnerability affecting the SQL Server Native Client OLE DB Provider. The CVSSv3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) yields a base score of 8.8 (HIGH). Connected documents confirm the CVE is part of a broader set of SQL Server NCDP vulnerabilit...

CVE-2024-37320

CVE-2024-37320 affects the SQL Server Native Client OLE DB Provider and enables remote code execution via the OLE DB client library. The vulnerability is network-facing with low attack complexity and requires user interaction, with high impact on confidentiality, integrity, and availability (CVSS...

CVE-2024-37330

CVE-2024-37330 affects the SQL Server Native Client OLE DB Provider and is described as a Remote Code Execution vulnerability with CVSSv3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8. Connected sources confirm the issue is part of SQL Server OLE DB client/provider components and that th...

CVE-2024-37331

CVE-2024-37331 — SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability. The connected documents identify this CVE as affecting the SQL Server Native Client OLE DB Provider and note it is addressed by the July 2024 Microsoft SQL Server security update (KB5040944), which list...

CVE-2024-37322

CVE-2024-37322 is a remote code execution vulnerability in the SQL Server Native Client OLE DB Provider. Affected component: SQL Server Native Client OLE DB Provider used by clients to connect to SQL Server. Underlying issue: remote code execution with network access (CVSSv3.1: AV:N/AC:L/PR:N/UI:...

CVE-2024-37333

CVE-2024-37333 is a Remote Code Execution vulnerability in the SQL Server Native Client OLE DB Provider. It is rated CVSSv3.1 8.8 (High) with network attack vector, low attack complexity, no privileges required, but user interaction is required. The connected sources indicate this entry is part o...

CVE-2024-37326

CVE-2024-37326 is a SQL Server Native Client OLE DB Provider Remote Code Execution vulnerability. The impact is high (CVSS v3.1: 8.8, Confidentiality/Integrity/Availability: High) with network attack vector, no privileges required, but user interaction is required. Affected component is the SQL S...

CVE-2024-37327

CVE-2024-37327 is a vulnerability in the SQL Server Native Client OLE DB Provider that enables remote code execution. The CVSSv3.1 base score is 8.8 (HIGH) with network attack vector, low attack complexity, no privileges required, but user interaction is required. Technical details in connected d...

CVE-2024-37329

CVE-2024-37329 is a remote code execution vulnerability in the SQL Server Native Client OLE DB Provider. The initial documents identify the affected component as the OLE DB Provider used by SQL Server clients, with the root cause described as a remote code execution path when interacting with the...

CVE-2024-37324

CVE-2024-37324 is a vulnerability in the SQL Server Native Client OLE DB Provider that enables remote code execution. The reliable sources in the provided documents confirm the affected component as the SQL Server Native Client OLE DB Provider and indicate an RCE impact. Microsoft has released up...

CVE-2024-35256

CVE-2024-35256 is a remote code execution vulnerability in the SQL Server Native Client OLE DB Provider. The issue affects the client driver component used to connect to SQL Server and enables arbitrary code execution if a vulnerable driver is used. The advisory data shows this CVE is included in...

CVE-2024-35271

CVE-2024-35271 is a remote code execution vulnerability in the SQL Server Native Client OLE DB Provider. The CVSS v3.1 score in the initial records is 8.8 (HIGH), with network attack vector, no privileges required, but user interaction needed, and impact on confidentiality, integrity, and availab...

CVE-2024-37321

CVE-2024-37321 is a SQL Server Native Client OLE DB Provider Remote Code Execution vulnerability. The connected data confirms affected component is the SQL Server Native Client OLE DB Provider and root cause is remote code execution via that provider. The CVSSv3.1 base score is 8.8 (HIGH), with a...

CVE-2026-67631

CVE-2026-67631 is a heap-based buffer overflow in Microsoft SQL Server that allows an unauthorized attacker to achieve remote code execution over a network. The vulnerability is rated CVSS 3.1 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating no privileges or user in...

CVE-2026-78442

CVE-2026-78442 is a heap-based buffer overflow in Windows OLE DB that allows an unauthorized attacker to achieve remote code execution over a network with user interaction. The CNA-assigned CVSS 3.1 score is 8.8 (High) with full impact on confidentiality, integrity, and availability. CISA's SSVC ...

CVE-2026-77485

CVE-2026-77485 is a use-after-free vulnerability in Microsoft SQL Server that allows an authorized attacker to elevate privileges locally . The flaw requires local access and low privileges, with high attack complexity and no user interaction, scoring CVSS 3.1 7.0 (HIGH) with full impact on confi...

CVE-2026-66819

CVE-2026-66819 is an SQL injection vulnerability in Microsoft SQL Server , caused by improper neutralization of special elements used in SQL commands. An authorized attacker can exploit it over a network to elevate privileges , with a CVSS 3.1 score of 8.8 (HIGH) and impacts rated High for confid...

CVE-2026-66814

Microsoft SQL Server is affected by an insufficient granularity of access control flaw that allows an authorized attacker to elevate privileges over a network. The vulnerability is rated CVSS 8.8 (High) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating that low-privilege network ac...

CVE-2026-77482

CVE-2026-77482 is a heap-based buffer overflow in Microsoft SQL Server that allows an unauthorized attacker to achieve remote code execution over a network. The CVSS 3.1 score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating low attack complexity but required user interac...

CVE-2026-67381

A heap-based buffer overflow in Microsoft SQL Server allows an authorized attacker to elevate privileges over a network . The CVSS 3.1 score is 8.8 (HIGH) , with an attack vector of network, low complexity, low privileges required, and no user interaction needed, resulting in high impact to confi...

CVE-2026-67388

CVE-2026-67388 is a heap-based buffer overflow in Microsoft SQL Server that allows an authorized attacker (low privileges) to achieve remote code execution over the network. The vulnerability is rated CVSS 3.1 8.8 (High) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating low attack ...

CVE-2026-68779

CVE-2026-68779 is an out-of-bounds read in Microsoft SQL Server that allows an authorized (low-privilege) attacker to disclose information over a network. The CVSS 3.1 score is 6.5 (MEDIUM) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N , indicating a high confidentiality impact with no int...

CVE-2026-77487

CVE-2026-77487 is an improper access control vulnerability in Microsoft SQL Server that allows an authorized attacker (low privileges required) to elevate privileges over a network with low complexity and no user interaction. The CVSS 3.1 base score is 8.8 (HIGH) , with high impact to confidentia...

CVE-2026-66818

Microsoft SQL Server is affected by an improper privilege management flaw that allows an authorized attacker to escalate privileges over a network . The vulnerability is rated CVSS 3.1 8.8 (High) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning low privileges and no user interaction ...

CVE-2026-67370

CVE-2026-67370 is an SQL injection vulnerability in Microsoft SQL Server where improper neutralization of special elements used in a SQL command allows an authorized attacker to elevate privileges over a network. The vulnerability carries a CVSS v3.1 score of 8.8 (HIGH) with a vector of AV:N/AC:L...

CVE-2026-67386

Microsoft SQL Server is affected by a use of uninitialized resource flaw that allows an authorized attacker (low privileges) to disclose information over a network. The vulnerability carries a CVSS 3.1 score of 6.5 (Medium) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating high con...

CVE-2026-68778

CVE-2026-68778 is an out-of-bounds read vulnerability in Microsoft SQL Server that allows an authorized attacker (low privileges required) to disclose information over a network . The CVSS 3.1 score is 6.5 (Medium) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting high confidential...

CVE-2026-77483

CVE-2026-77483 affects Microsoft SQL Server and involves a weak authentication mechanism that allows an authorized attacker (low privileges required) to elevate privileges over a network . The CVSS 3.1 score is 8.8 (HIGH) with vectors for network attack, low complexity, no user interaction, and h...

CVE-2026-77486

CVE-2026-77486 is a remote code execution vulnerability in Microsoft SQL Server caused by an integer overflow or wraparound , allowing an unauthorized attacker to execute code over a network. The vulnerability requires user interaction (UI:R) but demands no prior privileges (PR:N) and has low att...

CVE-2026-67384

Microsoft SQL Server is affected by an integer overflow or wraparound vulnerability that allows an authorized attacker to execute code over a network, leading to a remote code execution scenario. The CVSS 3.1 score is 8.8 (HIGH) with a network attack vector, low complexity, and low privileges req...

CVE-2026-66820

CVE-2026-66820 is an SQL injection vulnerability in SQL Server caused by improper neutralization of special elements in a SQL command. An authorized attacker with low privileges can exploit it over the network without user interaction to elevate privileges , resulting in high impact to confidenti...

CVE-2026-67633

Microsoft SQL Server is affected by an out-of-bounds read vulnerability that allows an authorized attacker (low privileges) to trigger a denial of service over the network. The CNA-assigned CVSS 3.1 score is 6.5 (MEDIUM) , reflecting network attack vector, low complexity, and high availability im...

CVE-2026-67648

Microsoft SQL Server is affected by a use of uninitialized resource vulnerability that allows an authorized attacker (low privileges) to disclose information over a network . The CVSS 3.1 base score is 6.5 (Medium) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating high confidential...

CVE-2026-68777

CVE-2026-68777 is an out-of-bounds read vulnerability in Microsoft SQL Server that allows an authorized attacker to disclose information over a network. The CVSS 3.1 base score is 6.5 (Medium) with high confidentiality impact but no integrity or availability impact. CISA's SSVC assessment rates e...

CVE-2026-77488

Microsoft SQL Server is affected by an integer underflow (wrap or wraparound) that allows an authorized local attacker to disclose information. The flaw requires low privileges and no user interaction, with a CVSS 3.1 score of 5.5 (MEDIUM) — high confidentiality impact but no integrity or availab...

CVE-2026-67385

Microsoft SQL Server is affected by a use-after-free vulnerability that allows an authorized attacker to achieve remote code execution over a network. The vulnerability is rated CVSS 8.8 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. CISA's SSVC assessment indicates no known exploit...

CVE-2026-67639

CVE-2026-67639 is a heap-based buffer overflow in Microsoft SQL Server that allows an authorized attacker (low privileges) to achieve remote code execution over a network. The CVSS 3.1 base score is 8.8 (HIGH) with full impact to confidentiality, integrity, and availability. No exploit availabili...

CVE-2026-68786

CVE-2026-68786 is a heap-based buffer overflow in Microsoft SQL Server that allows an authorized attacker (low privileges required) to achieve remote code execution over a network with no user interaction. The assigned CVSS 3.1 score is 8.8 (HIGH) with impacts of High across confidentiality, inte...

CVE-2026-67645

CVE-2026-67645 is an out-of-bounds read in Microsoft SQL Server that allows an authorized attacker to disclose information over a network . The CVSS 3.1 base score is 6.5 (MEDIUM) , reflecting low complexity, low privileges required, and high confidentiality impact with no integrity or availabili...

CVE-2026-67393

CVE-2026-67393 is a buffer over-read vulnerability in Microsoft SQL Server that allows an authorized attacker to disclose information over a network. The vulnerability is classified as information disclosure with a CVSS 3.1 base score of 6.5 (Medium) , requiring low privileges and no user interac...

CVE-2026-67368

Microsoft SQL Server is affected by an improper link resolution before file access ('link following') flaw that allows an authorized attacker to elevate privileges over a network. The root cause is a link following issue in how SQL Server resolves file links prior to access. Per the assigned CVSS...