Hi guys
A critical security vulnerability, tracked under EUVD-2026-43972 (Alias: CVE-2026-42990), has been disclosed affecting the SQL Server ODBC driver. Due to its severity and ease of exploitation, this flaw has been assigned a maximum-tier severity rating.
- Severity: Critical
- CVSS Base Score: 9.8 / 10
- Attack Vector: Network
- Privileges Required: None (Unauthenticated)
-Threat Overview
The vulnerability is a heap-based buffer overflow. It allows an unauthorized, remote attacker to exploit the driver over a network connection to achieve Remote Code Execution (RCE). Because no credentials are required, an attacker could potentially gain full control of the vulnerable system.
-Remediation
Since ODBC drivers are widely deployed across web servers, application servers, and administrator workstations, the attack surface is vast.
-
Action Required: Immediately identify all systems utilizing the SQL Server ODBC driver and apply the latest official security patches provided by Microsoft.
🔗 Reference: MSRC Update Guide (CVE-2026-42990)
