Sql Server 2019
CVE-2024-28938
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft) · only source for this CVE.
CVSS VectorVendor: microsoft
Lifecycle Timeline
1DescriptionCVE.org
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
AnalysisAI
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Out-of-bounds Read (CWE-125), which allows attackers to read data from memory outside the intended buffer boundaries. Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability Affected products include: Microsoft Odbc Driver For Sql Server, Microsoft Sql Server 2019, Microsoft Sql Server 2022, Microsoft Visual Studio 2019, Microsoft Visual Studio 2022.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate array indices and buffer lengths. Use memory-safe languages. Enable AddressSanitizer during testing.
More in Sql Server 2019
View allSQL Server 2016-2025 contains an improper access control flaw that allows authenticated network attackers to escalate pr
Microsoft SQL Server Elevation of Privilege Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is rem
Microsoft SQL Server Elevation of Privilege Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is rem
Remote code execution in Microsoft SQL Server 2019, 2022, and 2025 is achievable by an authenticated low-privilege attac
Heap-based buffer overflow in Microsoft SQL Server 2017 and 2019 enables unauthenticated network attackers to execute ar
Heap-based buffer overflow in Microsoft SQL Server (versions 2017 through 2025) enables any authenticated network attack
Remote code execution in Microsoft SQL Server 2017 and 2019 is enabled by an integer overflow that precipitates a heap-b
Privilege escalation in Microsoft SQL Server (2017 through 2025) allows a low-privileged authenticated network attacker
Privilege escalation in Microsoft SQL Server allows a network-authenticated low-privileged attacker to elevate to higher
Privilege escalation in Microsoft SQL Server allows a low-privileged, authenticated network attacker to elevate access r
Privilege escalation in Microsoft SQL Server 2017 through 2025 allows a low-privileged authenticated attacker to elevate
Microsoft SQL Server Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotel
Same weakness CWE-125 – Out-of-bounds Read
View allShare
External POC / Exploit Code
Leaving vuln.today