CVE-2024-48995

Deeper analysis

CVE-2024-48995 is a remote code execution vulnerability in SQL Server Native Client stemming from a heap-based buffer overflow (CWE-122). The flaw affects the client component used for database connectivity and carries a CVSS 3.1 score of 8.8, reflecting network attack vector, low complexity, and no required privileges.

An unauthenticated attacker can trigger the issue by sending specially crafted responses or content that a user interacts with, such as through an application using the Native Client library. Successful exploitation grants the attacker the ability to execute arbitrary code with the privileges of the affected process, resulting in full compromise of confidentiality, integrity, and availability.

The official Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-48995 addresses mitigation steps and available updates for supported SQL Server versions and client components.

The EPSS score rose from a low baseline to a peak of 0.0703, indicating emerging exploitation interest after disclosure before receding to the current value of 0.0223.