WDAC OLE DB Provider CVE-2026-72933

The victim must initiate an OLE DB connection to an attacker-controlled SQL Server endpoint. This can be triggered by: opening an Office document (Excel, Access) containing an embedded data connection pointing to the attacker's server; using any application or script that constructs an OLE DB/ADO connection string targeting the malicious server; or administrator-deployed SSIS packages or linked server configurations pointing to an attacker-compromised endpoint. The CVSS PR:N confirms no attacker-side credentials are required; the attacker merely needs to operate the server. UI:R is the primary limiting condition - fully automated exploitation (e.g., over open network scanning) is not feasible without user interaction. Exploitation is not limited by a specific non-default configuration: any Windows system with the WDAC OLE DB provider present (i.e., essentially all Windows installations) that processes an OLE DB connection to an attacker server is vulnerable.

The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) correctly reflects a client-side network attack where the attacker controls the server - no credentials on the attacker's side are needed (PR:N), but the victim must initiate a connection (UI:R). This UI:R requirement is the primary risk moderator: exploitation is not wormable and requires user interaction, such as opening an Office document with an embedded OLE DB data connection, clicking a crafted data source link, or using an application configured to query an attacker-controlled SQL endpoint. In enterprise environments this interaction surface is non-trivial - Excel pivot tables, Access linked tables, and SSIS packages can silently resolve OLE DB connections on open. No EPSS score was provided and the vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation at this time. No POC is publicly available. The breadth of affected Windows versions (Server 2012 through Server 2025, Windows 10 1607 through Windows 11 26H1) means almost every unpatched Windows system in production is vulnerable if it processes OLE DB data connections - prioritization should be high for environments running Office, database tools, or legacy ADO-based applications.

An attacker registers a domain and stands up a rogue SQL Server-compatible listener. They send a phishing email containing an Excel workbook whose data connection points to the attacker's server; when the victim opens the file and refreshes the data connection, the victim's WDAC OLE DB provider connects to the attacker's server and receives a specially crafted OLE DB response that triggers the heap overflow, executing attacker-supplied shellcode in the context of the user's session. No public proof-of-concept exists at time of analysis, but the low complexity (AC:L) indicates exploitation does not require precise heap grooming or timing.