CVE-2024-37338

Published: Sep 10, 2024Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: secure@microsoft.com (Secondary)

Description

Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability

Affected (8)

Products: Microsoft: Sql 2016 Azure Connect Feature Pack, Sql Server 2016, Sql Server 2017, Sql Server 2019, Sql Server 2022

5 products

Sql 2016 Azure Connect Feature Pack

Sql Server 2016

Sql Server 2017

Sql Server 2019

Sql Server 2022

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Microsoft Sql 2016 Azure Connect Feature Pack	From 13.0.7000.253 to 13.0.7037.1
Microsoft Sql Server 2016	From 13.0.6300.2 to 13.0.6441.1
Microsoft Sql Server 2017	From 14.0.1000.169 to 14.0.2060.1
Microsoft Sql Server 2017	From 14.0.3006.16 to 14.0.3475.1
Microsoft Sql Server 2019	From 15.0.2000.5 to 15.0.2120.1
Microsoft Sql Server 2019	From 15.0.4003.23 to 15.0.4390.2
Microsoft Sql Server 2022	From 16.0.1000.6 to 16.0.1125.1
Microsoft Sql Server 2022	From 16.0.4003.1 to 16.0.4140.3

Related CWEs

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-37338

Source: secure@microsoft.com

PatchVendor Advisory

Timeline

No history available yet.