CVE-2024-29985 - Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability · CoreCVE

Back Back to CVE browser

HIGH

Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Published Apr 9, 2024

8.8

HIGH

CVSS 3.1

EPSS 2.40%

Description

Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Affected products

Vendor Microsoft Product Microsoft OLE DB Driver 18 for SQL Server Default
n/a
- Version
  18.0.0
  Status
  affected
  Constraints
  <18.7.0002.0
Vendor Microsoft Product Microsoft OLE DB Driver 19 for SQL Server Default
n/a
- Version
  19.0.0
  Status
  affected
  Constraints
  <19.3.0003.0
Vendor Microsoft Product Microsoft SQL Server 2019 (CU 25) Default
n/a
- Version
  15.0.0
  Status
  affected
  Constraints
  <15.0.4360.2
Vendor Microsoft Product Microsoft SQL Server 2019 (GDR) Default
n/a
- Version
  15.0.0
  Status
  affected
  Constraints
  <15.0.2110.4
Vendor Microsoft Product Microsoft SQL Server 2022 (GDR) Default
n/a
- Version
  16.0.0
  Status
  affected
  Constraints
  <16.0.1115.1
Vendor Microsoft Product Microsoft SQL Server 2022 for (CU 12) Default
n/a
- Version
  16.0.0
  Status
  affected
  Constraints
  <16.0.4120.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft OLE DB Driver 18 for SQL Server

n/a

Version	Status	Constraints
18.0.0	affected	<18.7.0002.0

Microsoft OLE DB Driver 19 for SQL Server

n/a

Version	Status	Constraints
19.0.0	affected	<19.3.0003.0

Microsoft SQL Server 2019 (CU 25)

n/a

Version	Status	Constraints
15.0.0	affected	<15.0.4360.2

Microsoft SQL Server 2019 (GDR)

n/a

Version	Status	Constraints
15.0.0	affected	<15.0.2110.4

Microsoft SQL Server 2022 (GDR)

n/a

Version	Status	Constraints
16.0.0	affected	<16.0.1115.1

Microsoft SQL Server 2022 for (CU 12)

n/a

Version	Status	Constraints
16.0.0	affected	<16.0.4120.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-122

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-26957
Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29985
vendor-advisoryVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-26957		Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29985		vendor-advisoryVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published Apr 9, 2024

Updated May 3, 2025

Reserved Mar 22, 2024

Link CVE-2024-29985

CISA Vulnrichment

Updated Apr 23, 2024

Status Analyzed

Modified Jun 17, 2026

Link CVE-2024-29985

Severity n/a

Public date n/a

Links CVE-2024-29985

Assigner microsoft

Published Apr 9, 2024

Updated May 3, 2025

Exploited since n/a

Link EUVD-2024-26957

EUVD-2024-26957