CVE-2024-38255
Published: 12 November 2024
Summary
CVE-2024-38255 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Sql Server 2016. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 15.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-38255 is a remote code execution vulnerability in the SQL Server Native Client component. It carries a CVSS 3.1 score of 8.8 and is associated with CWE-122. The flaw permits an attacker to execute arbitrary code on affected systems when certain conditions are met during network communication with SQL Server Native Client.
An unauthenticated remote attacker can exploit the issue over the network with low attack complexity and no privileges required, provided the victim performs a user interaction such as opening a malicious file or connecting to a crafted server. Successful exploitation results in full confidentiality, integrity, and availability impact on the target system.
The EPSS score for this CVE started low after disclosure and rose materially to a peak of 0.0795 on 2025-12-11 before receding to the current value of 0.0223, indicating that exploitation interest increased after public release. The primary reference is the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38255.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-37805
Vulnerability details
SQL Server Native Client Remote Code Execution Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.