CVE-2024-49018

Published: Nov 12, 2024Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: secure@microsoft.com (Secondary)

Description

SQL Server Native Client Remote Code Execution Vulnerability

Affected (6)

Products: Microsoft: Sql Server 2016, Sql Server 2017, Sql Server 2019

3 products

Sql Server 2016

Sql Server 2017

Sql Server 2019

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Microsoft Sql Server 2016	13.0.6300.2 ≤ version < 13.0.6455.2
Microsoft Sql Server 2016	13.0.7000.253 ≤ version < 13.0.7050.2
Microsoft Sql Server 2017	14.0.1000.169 ≤ version < 14.0.2070.1
Microsoft Sql Server 2017	14.0.3006.16 ≤ version < 14.0.3485.1
Microsoft Sql Server 2019	15.0.2000.5 ≤ version < 15.0.2130.3
Microsoft Sql Server 2019	15.0.4003.23 ≤ version < 15.0.4410.1

Related CWEs

Numeric Truncation Error

Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49018

Source: secure@microsoft.com

PatchVendor Advisory

Timeline

No history available yet.