CVE-2023-21732 — Microsoft ODBC Driver Remote Code Execution Vulnerability

Back Back to CVE browser

HIGH

Microsoft ODBC Driver Remote Code Execution Vulnerability

Published Jan 10, 2023

8.8

HIGH

CVSS 3.1

EPSS 1.38%

Description

Microsoft ODBC Driver Remote Code Execution Vulnerability

Affected products

Vendor Microsoft Product Windows 10 Version 1507 Default
n/a
- Version
  10.0.10240.0
  Status
  affected
  Constraints
  <10.0.10240.19685
Vendor Microsoft Product Windows 10 Version 1607 Default
n/a
- Version
  10.0.14393.0
  Status
  affected
  Constraints
  <10.0.14393.5648
Vendor Microsoft Product Windows 10 Version 1809 Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <10.0.17763.3887
- Version
  10.0.17763.0
  Status
  affected
  Constraints
  <10.0.17763.3887
Vendor Microsoft Product Windows 10 Version 20H2 Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <10.0.19042.2486
Vendor Microsoft Product Windows 10 Version 21H2 Default
n/a
- Version
  10.0.19043.0
  Status
  affected
  Constraints
  <10.0.19044.2486
Vendor Microsoft Product Windows 10 Version 22H2 Default
n/a
- Version
  10.0.19045.0
  Status
  affected
  Constraints
  <10.0.19045.2486
Vendor Microsoft Product Windows 11 version 21H2 Default
n/a
- Version
  10.0.0
  Status
  affected
  Constraints
  <10.0.22000.1455
Vendor Microsoft Product Windows 11 version 22H2 Default
n/a
- Version
  10.0.22621.0
  Status
  affected
  Constraints
  <10.0.22621.1105
Vendor Microsoft Product Windows 7 Default
n/a
- Version
  6.1.0
  Status
  affected
  Constraints
  <6.1.7601.26321
Vendor Microsoft Product Windows 7 Service Pack 1 Default
n/a
- Version
  6.1.0
  Status
  affected
  Constraints
  <6.1.7601.26321
Vendor Microsoft Product Windows 8.1 Default
n/a
- Version
  6.3.0
  Status
  affected
  Constraints
  <6.3.9600.20778
Vendor Microsoft Product Windows Server 2008 Service Pack 2 Default
n/a
- Version
  6.0.6003.0
  Status
  affected
  Constraints
  <6.0.6003.21872
Vendor Microsoft Product Windows Server 2008 R2 Service Pack 1 Default
n/a
- Version
  6.1.7601.0
  Status
  affected
  Constraints
  <6.1.7601.26321
Vendor Microsoft Product Windows Server 2008 R2 Service Pack 1 (Server Core installation) Default
n/a
- Version
  6.1.7601.0
  Status
  affected
  Constraints
  <6.1.7601.26321
Vendor Microsoft Product Windows Server 2008 Service Pack 2 Default
n/a
- Version
  6.0.6003.0
  Status
  affected
  Constraints
  <6.0.6003.21872
Vendor Microsoft Product Windows Server 2008 Service Pack 2 (Server Core installation) Default
n/a
- Version
  6.0.6003.0
  Status
  affected
  Constraints
  <6.0.6003.21872
Vendor Microsoft Product Windows Server 2012 Default
n/a
- Version
  6.2.9200.0
  Status
  affected
  Constraints
  <6.2.9200.24075
Vendor Microsoft Product Windows Server 2012 (Server Core installation) Default
n/a
- Version
  6.2.9200.0
  Status
  affected
  Constraints
  <6.2.9200.24075
Vendor Microsoft Product Windows Server 2012 R2 Default
n/a
- Version
  6.3.9600.0
  Status
  affected
  Constraints
  <6.3.9600.20778
Vendor Microsoft Product Windows Server 2012 R2 (Server Core installation) Default
n/a
- Version
  6.3.9600.0
  Status
  affected
  Constraints
  <6.3.9600.20778
Vendor Microsoft Product Windows Server 2016 Default
n/a
- Version
  10.0.14393.0
  Status
  affected
  Constraints
  <10.0.14393.5648
Vendor Microsoft Product Windows Server 2016 (Server Core installation) Default
n/a
- Version
  10.0.14393.0
  Status
  affected
  Constraints
  <10.0.14393.5648
Vendor Microsoft Product Windows Server 2019 Default
n/a
- Version
  10.0.17763.0
  Status
  affected
  Constraints
  <10.0.17763.3887
Vendor Microsoft Product Windows Server 2019 (Server Core installation) Default
n/a
- Version
  10.0.17763.0
  Status
  affected
  Constraints
  <10.0.17763.3887
Vendor Microsoft Product Windows Server 2022 Default
n/a
- Version
  10.0.20348.0
  Status
  affected
  Constraints
  <10.0.20348.1487

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft

Windows 10 Version 1507

n/a

Version	Status	Constraints
10.0.10240.0	affected	<10.0.10240.19685

Microsoft

Windows 10 Version 1607

n/a

Version	Status	Constraints
10.0.14393.0	affected	<10.0.14393.5648

Microsoft

Windows 10 Version 1809

n/a

Version	Status	Constraints
10.0.0	affected	<10.0.17763.3887
10.0.17763.0	affected	<10.0.17763.3887

Microsoft

Windows 10 Version 20H2

n/a

Version	Status	Constraints
10.0.0	affected	<10.0.19042.2486

Microsoft

Windows 10 Version 21H2

n/a

Version	Status	Constraints
10.0.19043.0	affected	<10.0.19044.2486

Microsoft

Windows 10 Version 22H2

n/a

Version	Status	Constraints
10.0.19045.0	affected	<10.0.19045.2486

Microsoft

Windows 11 version 21H2

n/a

Version	Status	Constraints
10.0.0	affected	<10.0.22000.1455

Microsoft

Windows 11 version 22H2

n/a

Version	Status	Constraints
10.0.22621.0	affected	<10.0.22621.1105

Microsoft

Windows 7

n/a

Version	Status	Constraints
6.1.0	affected	<6.1.7601.26321

Microsoft

Windows 7 Service Pack 1

n/a

Version	Status	Constraints
6.1.0	affected	<6.1.7601.26321

Microsoft

Windows 8.1

n/a

Version	Status	Constraints
6.3.0	affected	<6.3.9600.20778

Microsoft

Windows Server 2008 Service Pack 2

n/a

Version	Status	Constraints
6.0.6003.0	affected	<6.0.6003.21872

Microsoft

Windows Server 2008 R2 Service Pack 1

n/a

Version	Status	Constraints
6.1.7601.0	affected	<6.1.7601.26321

Microsoft

Windows Server 2008 R2 Service Pack 1 (Server Core installation)

n/a

Version	Status	Constraints
6.1.7601.0	affected	<6.1.7601.26321

Microsoft

Windows Server 2008 Service Pack 2

n/a

Version	Status	Constraints
6.0.6003.0	affected	<6.0.6003.21872

Microsoft

Windows Server 2008 Service Pack 2 (Server Core installation)

n/a

Version	Status	Constraints
6.0.6003.0	affected	<6.0.6003.21872

Microsoft

Windows Server 2012

n/a

Version	Status	Constraints
6.2.9200.0	affected	<6.2.9200.24075

Microsoft

Windows Server 2012 (Server Core installation)

n/a

Version	Status	Constraints
6.2.9200.0	affected	<6.2.9200.24075

Microsoft

Windows Server 2012 R2

n/a

Version	Status	Constraints
6.3.9600.0	affected	<6.3.9600.20778

Microsoft

Windows Server 2012 R2 (Server Core installation)

n/a

Version	Status	Constraints
6.3.9600.0	affected	<6.3.9600.20778

Microsoft

Windows Server 2016

n/a

Version	Status	Constraints
10.0.14393.0	affected	<10.0.14393.5648

Microsoft

Windows Server 2016 (Server Core installation)

n/a

Version	Status	Constraints
10.0.14393.0	affected	<10.0.14393.5648

Microsoft

Windows Server 2019

n/a

Version	Status	Constraints
10.0.17763.0	affected	<10.0.17763.3887

Microsoft

Windows Server 2019 (Server Core installation)

n/a

Version	Status	Constraints
10.0.17763.0	affected	<10.0.17763.3887

Microsoft

Windows Server 2022

n/a

Version	Status	Constraints
10.0.20348.0	affected	<10.0.20348.1487

Remediation

No remediation recorded yet.

Metrics

1.38% 0.01376

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01376

Score over time

2023–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (35 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.38% (0.01376)	71.04th	v5 (v2026.06.15)
Jun 15, 2026	1.38% (0.01376)	68.38th	v5 (v2026.06.15)
May 6, 2026	6.72% (0.06723)	91.31th	v4 (v2025.03.14)
Jan 22, 2026	4.29% (0.04291)	88.53th	v4 (v2025.03.14)
Nov 21, 2025	1.14% (0.01139)	77.78th	v4 (v2025.03.14)
Nov 18, 2025	6.41% (0.06408)	90.10th	v4 (v2025.03.14)
Mar 30, 2025	0.89% (0.00887)	73.35th	v4 (v2025.03.14)
Mar 29, 2025	1.95% (0.01953)	72.56th	v4 (v2025.03.14)
Mar 17, 2025	0.19% (0.00186)	38.16th	v4 (v2025.03.14)
Dec 17, 2024	0.61% (0.00607)	78.42th	v3 (v2023.03.01)
Dec 12, 2024	1.73% (0.01727)	88.37th	v3 (v2023.03.01)
Jul 5, 2024	1.79% (0.01785)	88.19th	v3 (v2023.03.01)
Jun 22, 2024	1.67% (0.01671)	87.74th	v3 (v2023.03.01)
Feb 12, 2024	1.88% (0.01878)	88.02th	v3 (v2023.03.01)
Jan 17, 2024	2.27% (0.02268)	88.49th	v3 (v2023.03.01)
Dec 11, 2023	2.74% (0.02739)	89.42th	v3 (v2023.03.01)
Nov 30, 2023	2.54% (0.02540)	89.03th	v3 (v2023.03.01)
Nov 17, 2023	6.13% (0.06131)	92.75th	v3 (v2023.03.01)
Nov 6, 2023	5.03% (0.05025)	92.00th	v3 (v2023.03.01)
Oct 25, 2023	8.18% (0.08176)	93.61th	v3 (v2023.03.01)
Sep 22, 2023	5.94% (0.05943)	92.57th	v3 (v2023.03.01)
Aug 19, 2023	4.83% (0.04829)	91.74th	v3 (v2023.03.01)
Jul 18, 2023	3.22% (0.03223)	89.89th	v3 (v2023.03.01)
Jun 23, 2023	2.05% (0.02048)	87.40th	v3 (v2023.03.01)
Jun 15, 2023	2.68% (0.02681)	88.94th	v3 (v2023.03.01)
May 15, 2023	1.39% (0.01392)	84.37th	v3 (v2023.03.01)
May 8, 2023	1.26% (0.01255)	83.49th	v3 (v2023.03.01)
Apr 28, 2023	16.77% (0.16770)	95.23th	v3 (v2023.03.01)
Apr 19, 2023	17.20% (0.17204)	95.27th	v3 (v2023.03.01)
Apr 14, 2023	12.69% (0.12693)	94.59th	v3 (v2023.03.01)
Mar 25, 2023	5.38% (0.05376)	91.90th	v3 (v2023.03.01)
Mar 7, 2023	2.81% (0.02815)	89.04th	v3 (v2023.03.01)
Mar 6, 2023	1.60% (0.01601)	75.58th	v2 (v2022.01.01)
Jan 19, 2023	1.60% (0.01601)	74.98th	v2 (v2022.01.01)
Jan 11, 2023	1.16% (0.01156)	60.66th	v2 (v2022.01.01)

Weaknesses (1)

CWE-121

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21732
vendor-advisory

Link	Providers	Tags
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21732		vendor-advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published Jan 10, 2023

Updated Feb 28, 2025

Reserved Dec 13, 2022

Link CVE-2023-21732

CISA Vulnrichment

Updated Feb 28, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2023-21732

Red Hat

Severity n/a

Public date n/a

Links CVE-2023-21732