CVE-2024-49013

Deeper analysis

CVE-2024-49013 is a remote code execution vulnerability in the SQL Server Native Client component. It carries a CVSS 3.1 base score of 8.8 with an attack vector of network, low attack complexity, no required privileges, and required user interaction, resulting in high impact to confidentiality, integrity, and availability. The weakness is tracked under CWE-122.

An unauthenticated remote attacker can exploit the flaw by convincing a user to interact with specially crafted content, such as opening a malicious file or visiting a web page that triggers the vulnerable client code. Successful exploitation grants the attacker the ability to execute arbitrary code in the context of the affected process.

Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49013 provides official guidance on available patches and mitigations. The EPSS score rose from a low baseline to a peak of 0.0703 on 2025-12-11 before receding to the current value of 0.0403, indicating that exploitation interest increased after disclosure.