CVE-2024-48996

Deeper analysis

CVE-2024-48996 is a remote code execution vulnerability in the SQL Server Native Client component, assigned CWE-122 for a heap-based buffer overflow condition. It carries a CVSS 3.1 base score of 8.8 reflecting network attack vector, low attack complexity, and no required privileges, with impacts to confidentiality, integrity, and availability all rated high.

An unauthenticated remote attacker can trigger the flaw by supplying a malicious payload that a user interacts with, resulting in arbitrary code execution on the affected system. The vulnerability is exploitable over the network without prior authentication when the Native Client processes attacker-controlled input.

Microsoft's advisory at the referenced MSRC link provides patch guidance and mitigation details for supported SQL Server versions. The EPSS score rose from lower values to a peak of 0.0703 before receding to the current 0.0223, indicating a period of increased exploitation interest after disclosure.