Skip to main content

Sql Server 2017 CVE-2024-37966

HIGH
Out-of-bounds Read (CWE-125)
2024-09-10 secure@microsoft.com
Buffer Overflow Information Disclosure Microsoft Sql Server 2017 Sql Server 2019 Sql Server 2022
7.1
CVSS 3.1 · Vendor: microsoft
Share

Severity by source

Vendor (microsoft) PRIMARY
7.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Primary rating from Vendor (microsoft) · only source for this CVE.

CVSS VectorVendor: microsoft

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
Low

Lifecycle Timeline

1
CVE Published
Sep 10, 2024 - 17:15 cve.org
HIGH 7.1

DescriptionCVE.org

Microsoft SQL Server Native Scoring Information Disclosure Vulnerability

AnalysisAI

Microsoft SQL Server Native Scoring Information Disclosure Vulnerability. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Out-of-bounds Read (CWE-125), which allows attackers to read data from memory outside the intended buffer boundaries. Microsoft SQL Server Native Scoring Information Disclosure Vulnerability Affected products include: Microsoft Sql Server 2017, Microsoft Sql Server 2019, Microsoft Sql Server 2022.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate array indices and buffer lengths. Use memory-safe languages. Enable AddressSanitizer during testing.

More in Sql Server 2017

View all
CVE-2026-21262 HIGH POC
8.8 Mar 10

SQL Server 2016-2025 contains an improper access control flaw that allows authenticated network attackers to escalate pr
CVE-2024-37341 CRITICAL
9.8 Sep 10

Microsoft SQL Server Elevation of Privilege Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is rem
CVE-2024-37980 CRITICAL
9.8 Sep 10

Microsoft SQL Server Elevation of Privilege Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is rem
CVE-2024-37965 HIGH
8.8 Sep 10

Microsoft SQL Server Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotel
CVE-2024-37340 HIGH
8.8 Sep 10

Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerabil
CVE-2024-37339 HIGH
8.8 Sep 10

Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerabil
CVE-2024-37338 HIGH
8.8 Sep 10

Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerabil
CVE-2024-37335 HIGH
8.8 Sep 10

Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerabil
CVE-2024-26191 HIGH
8.8 Sep 10

Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerabil
CVE-2024-26186 HIGH
8.8 Sep 10

Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerabil
CVE-2025-49759 HIGH
8.8 Aug 12

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized

CVE-2025-49758 HIGH
8.8 Aug 12

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Share

CVE-2024-37966 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy