CVE-2026-78442: Windows OLE DB Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to execute code over a network.
Other sources
Windows OLE DB Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.0.4490.9Patch KB5122772 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.0.2190.7Patch KB5122773 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.0.3550.4Patch KB5122774 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.0.2130.4Patch KB5122775
Event History
Frequently Asked Questions
Does exploitation require an authenticated account or a complex attack path?
The supplied vector indicates network reachability, low attack complexity, no privileges required, and user interaction required. The description identifies a heap-based buffer overflow in Windows OLE DB that can lead to code execution.
Which listed SQL Server deployments should be prioritized for review?
The affected software list includes Microsoft SQL Server 2017, Microsoft SQL Server 2017 CU 31, Microsoft SQL Server 2019, and Microsoft SQL Server 2019 CU 32. The data does not identify fixed versions or update guidance.
What is the potential impact if exploitation succeeds?
The provided severity vector rates confidentiality, integrity, and availability impact as high. Successful exploitation may allow an unauthorized attacker to execute code over the network.