CVE-2024-43462

Deeper analysis

CVE-2024-43462 is a remote code execution vulnerability in SQL Server Native Client, assigned CWE-122 for a likely heap-based buffer overflow. The flaw affects the Native Client component used by applications connecting to Microsoft SQL Server and carries a CVSS 3.1 score of 8.8 reflecting network attack vector, low complexity, and no required privileges.

An unauthenticated attacker can exploit the issue over the network by convincing a user to interact with malicious content, such as opening a crafted file or visiting a hostile webpage that triggers the vulnerable client code. Successful exploitation grants the attacker full control over the affected process, enabling arbitrary code execution with impacts to confidentiality, integrity, and availability.

The official Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43462 provides patch and mitigation guidance. The associated EPSS score rose from a low baseline to a peak of 0.0703 on 2025-12-11 before receding to the current value of 0.0223, indicating a temporary increase in observed exploitation interest after disclosure.