CVE-2026-78442: Windows OLE DB Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to execute code over a network.
Other sources
Windows OLE DB Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Event History
Frequently Asked Questions
Does exploitation require an authenticated account or a complex attack path?
The supplied vector indicates network reachability, low attack complexity, no privileges required, and user interaction required. The description identifies a heap-based buffer overflow in Windows OLE DB that can lead to code execution.
Which listed SQL Server deployments should be prioritized for review?
The affected software list includes Microsoft SQL Server 2017, Microsoft SQL Server 2017 CU 31, Microsoft SQL Server 2019, and Microsoft SQL Server 2019 CU 32. The data does not identify fixed versions or update guidance.
What is the potential impact if exploitation succeeds?
The provided severity vector rates confidentiality, integrity, and availability impact as high. Successful exploitation may allow an unauthorized attacker to execute code over the network.