CVE-2026-42990

What it actually does

This vulnerability is a network-reachable heap-based buffer overflow in the Microsoft SQL Server ODBC driver on affected Windows client and server platforms. A crafted SQL Server protocol interaction can cause the driver to write past the bounds of heap memory, potentially corrupting process memory and allowing arbitrary code execution in the context of the application or service using the vulnerable ODBC driver. Because the CVSS vector is network, low complexity, no privileges, and no user interaction, successful exploitation can provide full confidentiality, integrity, and availability impact for the compromised process and potentially the host, depending on the process privileges.

Why it matters to the business

Systems and applications that use the vulnerable SQL Server ODBC driver could be remotely compromised, allowing attackers to steal data, alter application behavior, deploy malware, or disrupt services. The affected product list spans supported Windows desktop and server releases, so exposure may be broad in organizations with database-connected applications, middleware, reporting tools, ETL jobs, or legacy ODBC integrations. Although this issue is not currently listed in CISA KEV, has no reported ransomware association, and has a low EPSS score with no 30-day increase, the 9.8 CVSS severity and unauthenticated remote code execution potential make timely patching important.

How an attack unfolds

An attacker targets software that loads the vulnerable SQL Server ODBC driver and communicates with a SQL Server-compatible endpoint over the network. The attacker may operate a malicious database endpoint, compromise or spoof a database server, redirect a client connection, or otherwise inject crafted protocol data into the ODBC communication path. When the vulnerable driver parses the malformed network data, a heap buffer overflow is triggered. With a reliable exploit, the attacker shapes the memory corruption to gain code execution inside the calling process. The resulting access runs with the privileges of that process, which may be a desktop application, service account, scheduled job, web application worker, integration service, or other database-connected workload. Post-exploitation activity may include credential theft, lateral movement, payload deployment, data access through trusted application paths, and service disruption.

How to fix it

Apply the Microsoft security updates that address CVE-2026-42990 on all affected Windows versions: Windows 10 1607, 1809, 21H2, 22H2; Windows 11 24H2, 25H2, 26H1; Windows Server 2012, 2016, 2019, 2022, and 2025. Because no exact fixed package versions were provided, use the latest Microsoft cumulative/security update level for the applicable OS and verify the SQL Server ODBC driver components were updated. If standalone Microsoft ODBC Driver for SQL Server packages are installed, update those packages from Microsoft as well. Where immediate patching is not possible, reduce exposure by restricting outbound database connections to trusted SQL Server endpoints, enforcing TLS certificate validation for database connections, preventing untrusted connection-string changes, blocking DNS/proxy redirection to untrusted database hosts, and isolating high-risk database-connected applications. Restart affected applications or hosts after patching if required so updated driver libraries are loaded.

How to confirm the fix worked

Confirm that each affected Windows system has installed the relevant Microsoft security update released on or after the vendor fix for this issue. Inventory systems for SQL Server ODBC driver components and verify file versions against Microsoft’s advisory or update catalog once fixed version details are available. Validate that applications using ODBC have been restarted and are loading the patched driver libraries rather than older bundled or side-by-side copies. Test database connectivity after patching to confirm application compatibility. For exposure validation, identify applications, services, scheduled tasks, and middleware that use SQL Server ODBC connections; review whether they can connect only to trusted database endpoints; and confirm DNS, proxy, firewall, and connection-string controls prevent redirection to attacker-controlled SQL Server-compatible services.

Typical attack path

1. Identify Windows systems or applications that use the SQL Server ODBC driver for database connectivity.
2. Find a way to influence the SQL Server protocol traffic received by the vulnerable driver, such as malicious server control, server compromise, DNS redirection, connection-string manipulation, man-in-the-middle positioning, or traffic injection.
3. Send specially crafted SQL Server protocol data to the vulnerable ODBC client.
4. Trigger heap memory corruption when the driver parses the malformed data.
5. Achieve arbitrary code execution in the process that loaded the driver.
6. Use the compromised process privileges to access data, dump credentials, move laterally, install persistence, or disrupt operations.

How to detect it

To determine whether exploitation may have occurred, review endpoint, application, and network telemetry for abnormal behavior from processes that use SQL Server ODBC connectivity. Useful log sources include Windows Event Logs, application logs, crash dumps, EDR telemetry, Sysmon logs, SQL Server client/application logs, DNS logs, proxy logs, firewall logs, and network flow records. Look for access violations or heap corruption crashes in applications that load ODBC driver DLLs, especially near the time of outbound SQL Server connections. Hunt for unexpected SQL Server/TDS traffic, particularly outbound connections to unfamiliar hosts or external IPs on TCP 1433 or nonstandard database ports. Investigate processes that load SQL Server ODBC driver libraries and then spawn command shells, scripting engines, download tools, or make unusual network connections. Because no public exploit maturity or specific exploit signature is provided, detection should focus on behavioral indicators: database-client redirection, anomalous driver crashes, suspicious child processes, memory-corruption events, credential access, and post-compromise activity following ODBC connection attempts.

• Exception code: 0xc0000005
• Faulting module name: sqlsrv32.dll
• Faulting module name: msodbcsql17.dll
• Faulting module name: msodbcsql18.dll
• Faulting module name: odbc32.dll
• Application Error
• Windows Error Reporting
• Heap corruption
• 0xc0000374
• outbound tcp/1433
• Process loaded module: sqlsrv32.dll
• Process loaded module: msodbcsql17.dll
• Process loaded module: msodbcsql18.dll
• odbcad32.exe
• powershell.exe spawned by database-connected application process
• cmd.exe spawned by database-connected application process
• wscript.exe spawned by database-connected application process
• cscript.exe spawned by database-connected application process
• rundll32.exe spawned by database-connected application process
• regsvr32.exe spawned by database-connected application process

What your security team should do

• Prioritize patching internet-exposed, DMZ, high-privilege, and business-critical systems that run database-connected applications using SQL Server ODBC.
• Create an inventory of Windows hosts and applications that use Microsoft SQL Server ODBC drivers, including bundled application runtimes and standalone ODBC driver installations.
• Restrict database egress so ODBC clients can connect only to approved SQL Server endpoints on approved ports.
• Enforce encrypted SQL Server connections with certificate validation where supported, reducing the chance of spoofed or intercepted database traffic.
• Review application configuration management to prevent unauthorized connection-string, DNS, proxy, or host-file changes that could redirect database clients.
• Increase monitoring for crashes or access violations in ODBC-loading processes, especially around database connection activity.
• Hunt for unusual outbound SQL Server traffic to unfamiliar hosts, newly observed database endpoints, or unexpected external IP addresses.
• Treat successful exploitation as potential full compromise of the affected process and investigate for credential theft, lateral movement, and persistence.
• Track Microsoft advisory updates for exact fixed file versions and any change in exploit maturity, KEV status, or ransomware use.