CVE-2022-34727

Deeper analysis

Microsoft ODBC Driver contains a remote code execution vulnerability tracked as CVE-2022-34727. The flaw affects the Microsoft ODBC Driver component and carries a CVSS 3.1 base score of 8.8, reflecting a network-accessible attack that requires no privileges and only limited user interaction to achieve full confidentiality, integrity, and availability impact.

An unauthenticated remote attacker can exploit the issue by supplying a malicious ODBC connection string or response that triggers code execution on the victim system. Successful exploitation grants the attacker the ability to run arbitrary code with the privileges of the affected process, potentially leading to complete compromise of the target host.

Microsoft has published remediation guidance and security updates for the vulnerability through its Security Response Center at the referenced advisory URL. Administrators should apply the vendor-supplied patches to affected ODBC Driver installations.

The associated EPSS score has remained steady at 0.1353 with no material increase observed since disclosure.