Summary
Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.
Details
According to the CVSS metric, the attack complexity is high (AC:H). What does this mean for this vulnerability?
An attacker would need specific conditions to be in place (i.e. particular protocol settings, or configurations, etc.) before an attack could succeed, which reduces the likelihood of widespread or opportunistic exploitation.
How could an attacker exploit this vulnerability?
An attacker could exploit this vulnerability by setting up a malicious SQL Server and convincing a user or application to connect to it. When the connection is made, the malicious server could send specially crafted network data that triggers the flaw in the affected component, potentially causing the client application to behave unexpectedly or stop responding.
Security updates
10.0.17763.9020 — https://support.microsoft.com/help/5099538
10.0.20348.5386 — https://support.microsoft.com/help/5099540
10.0.19044.7548 — https://support.microsoft.com/help/5099539
10.0.26100.33158 — https://support.microsoft.com/help/5099536
10.0.26200.8875 — https://support.microsoft.com/help/5101650
10.0.22631.7376 — https://support.microsoft.com/help/5099414
10.0.28000.2525 — https://support.microsoft.com/help/5101649
10.0.28000.2269 — https://support.microsoft.com/help/5095051
10.0.14393.9339 — https://support.microsoft.com/help/5099535
6.2.9200.26132 — https://support.microsoft.com/help/5094042
6.3.9600.23228 — https://support.microsoft.com/help/5094041
Vulnerabilities 1
-
Critical 9.8
SQL Server ODBC driver Elevation of Privilege Vulnerability
Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network.
Revision history
-
#1
Information published.
References
-
CVE-2026-42990 SQL Server ODBC driver Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42990
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss