CVE-2024-49008

Deeper analysis

CVE-2024-49008 is a remote code execution vulnerability in the SQL Server Native Client component. It carries a CVSS 3.1 base score of 8.8 with an attack vector of network, low complexity, no required privileges, and required user interaction, resulting in high impact to confidentiality, integrity, and availability. The weakness is tracked under CWE-122.

An unauthenticated attacker can exploit the flaw over a network connection to execute arbitrary code on an affected system. Successful exploitation requires the victim to interact with attacker-controlled content, after which the attacker can achieve full control equivalent to the privileges of the running process.

The official Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49008 provides patch and mitigation guidance. The EPSS score rose from a low baseline to a peak of 0.0703 on 2025-12-11 before receding to the current value of 0.0403, indicating a period of increased exploitation interest following disclosure.