Read the docs
TI-2023-12853 Aliases CVE-2023-28304GHSA-wq9v-8v42-w2gw

Microsoft ODBC and OLE DB Remote Code Execution Vulnerability

Priority LOW 38CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from Microsoft.

Summary

Microsoft ODBC and OLE DB Remote Code Execution Vulnerability

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00817 57th percentileScored 2026-11-07
Fix Fixed Microsoft ODBC Driver 17 for SQL Server (Microsoft): 17.10.3.1Microsoft OLE DB Driver 18 for SQL Server (Microsoft): 18.6.5+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft ODBC Driver 17 for SQL Server17.0.0.0 to before 17.10.3.117.10.3.1Patch availableCNA
MicrosoftMicrosoft OLE DB Driver 18 for SQL Server18.0.0 to before 18.6.518.6.5Patch availableCNA
MicrosoftMicrosoft OLE DB Driver 19 for SQL Server19.0.0 to before 19.3.019.3.0Patch availableCNA
MicrosoftMicrosoft ODBC Driver 18 for SQL Server18.0.0.0 to before 18.2.1.118.2.1.1Patch availableCNA
  • Microsoft ODBC Driver 17 for SQL Server VendorMicrosoft Affected 17.0.0.0 to before 17.10.3.1 Fixed in 17.10.3.1 Patch available CNA
  • Microsoft OLE DB Driver 18 for SQL Server VendorMicrosoft Affected 18.0.0 to before 18.6.5 Fixed in 18.6.5 Patch available CNA
  • Microsoft OLE DB Driver 19 for SQL Server VendorMicrosoft Affected 19.0.0 to before 19.3.0 Fixed in 19.3.0 Patch available CNA
  • Microsoft ODBC Driver 18 for SQL Server VendorMicrosoft Affected 18.0.0.0 to before 18.2.1.1 Fixed in 18.2.1.1 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:odbc:*:*:*:*:*:sql_server:*:*17.0 to before 17.10.3.1; 18.0 to before 18.2.1.1VulnerableMicrosoft
cpe:2.3:a:microsoft:ole_db:*:*:*:*:*:sql_server:*:*18.0 to before 18.6.5; 19.1.0 to before 19.3.0VulnerableMicrosoft
  • cpe:2.3:a:microsoft:odbc:*:*:*:*:*:sql_server:*:* Versions 17.0 to before 17.10.3.1; 18.0 to before 18.2.1.1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:ole_db:*:*:*:*:*:sql_server:*:* Versions 18.0 to before 18.6.5; 19.1.0 to before 19.3.0 Vulnerable ·Microsoft

Remediation

  • Fix · CNA Microsoft ODBC Driver 17 for SQL Server (Microsoft) Fixed in 17.10.3.1
  • Fix · CNA Microsoft OLE DB Driver 18 for SQL Server (Microsoft) Fixed in 18.6.5
  • Fix · CNA Microsoft OLE DB Driver 19 for SQL Server (Microsoft) Fixed in 19.3.0
  • Fix · CNA Microsoft ODBC Driver 18 for SQL Server (Microsoft) Fixed in 18.2.1.1

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Remote Code Execution
Exploited
No
Publicly disclosed
—
Exploitability
Exploitation Less Likely
ProductStatusPlan or fix
Microsoft ODBC Driver 17 for SQL ServerFixed 17.10.3.1 · Security Update
Microsoft ODBC Driver 18 for SQL ServerFixed 18.2.1.1 · Security Update
Microsoft OLE DB Driver 18 for SQL ServerFixed 18.6.5 · Security Update
Microsoft OLE DB Driver 19 for SQL ServerFixed 19.3.0 · Security Update

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-28304
  2. 2026-10-03 Alias added: GHSA-wq9v-8v42-w2gw

References

Patch 1

  • TI-2023-09221 Microsoft ODBC and OLE DB Remote Code Execution Vulnerability CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences