CVE-2024-38087

Deeper analysis

CVE-2024-38087 is a remote code execution vulnerability in the SQL Server Native Client OLE DB Provider. The flaw carries a CVSS 3.1 score of 8.8 and is associated with CWE-415 (double-free). It affects Microsoft SQL Server Native Client installations that expose the OLE DB interface to untrusted input.

An unauthenticated remote attacker can trigger the issue by supplying a malicious OLE DB connection string or query response that the provider processes. Successful exploitation grants the attacker the ability to execute arbitrary code with the privileges of the affected process, potentially leading to full system compromise, data exfiltration, or persistence.

Microsoft’s advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38087 recommends applying the security updates released on July 9, 2024, which address the double-free condition in supported versions of SQL Server Native Client. Administrators are advised to install the patches promptly and to restrict exposure of OLE DB endpoints where feasible.

The associated EPSS score has remained flat at 0.0718 with no material increase since disclosure, indicating limited observed exploitation interest to date.