High · 8.8 CVE-2024-49007 EUVD-2024-43884GHSA-37x8-vc3h-28p6

SQL Server Native Client Remote Code Execution Vulnerability

Published Nov 12, 2024 · Updated Jul 8, 2025 · Assigned by microsoft

Vendor: Microsoft Product: Microsoft SQL Server 2016 Service Pack 3 (GDR) Product: Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack Product: Microsoft SQL Server 2017 (CU 31) Product: Microsoft SQL Server 2017 (GDR) Product: Microsoft SQL Server 2019 (CU 29) Product: Microsoft SQL Server 2019 (GDR)

Description

SQL Server Native Client Remote Code Execution Vulnerability

Affected products

Vendor	Product	Affected	Fixed
Microsoft	Microsoft SQL Server 2017 (GDR)	14.0.0 – < 14.0.2070.1	14.0.2070.1
Microsoft	Microsoft SQL Server 2019 (GDR)	15.0.0 – < 15.0.2130.3	15.0.2130.3
Microsoft	Microsoft SQL Server 2016 Service Pack 3 (GDR)	13.0.0 – < 13.0.6455.2	13.0.6455.2
Microsoft	Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack	13.0.0 – < 13.0.7050.2	13.0.7050.2
Microsoft	Microsoft SQL Server 2017 (CU 31)	14.0.0 – < 14.0.3485.1	14.0.3485.1
Microsoft	Microsoft SQL Server 2019 (CU 29)	15.0.0 – < 15.0.4410.1	15.0.4410.1

Advisories 3

WID-SEC-2024-3451 Microsoft SQL Server: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Nov 12, 2024
NCSC-2024-0437 Kwetsbaarheden verholpen in Microsoft SQL Server NCSC-NL (Netherlands) · Nov 12, 2024
MSRC-CVE-2024-49007 SQL Server Native Client Remote Code Execution Vulnerability Microsoft Security Response Center · Nov 12, 2024

References

SQL Server Native Client Remote Code Execution Vulnerability vendor-advisory