External risk intelligence

SQL Server ODBC Driver Heap Overflow Network Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-42990

The vulnerability affects a database driver (ODBC). While network-accessible, database drivers are typically utilized by applications to connect to internal database servers. They are not intended to be exposed directly to the public internet, and such a configuration would be highly atypical.

Buffer Overflow

Microsoft Windows 10 1607

before 10.0.14393.9339before 10.0.17763.9020before 10.0.19044.7548before 10.0.19045.7548before 10.0.26100.8875before 10.0.26200.8875before 10.0.28000.2269r2before 10.0.20348.5386b...

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the SQL Server ODBC driver, enabling unauthorized attackers to execute code remotely. This issue, stemming from a heap-based buffer overflow, poses a significant risk if the affected component is exposed to the network. The primary concern is to confirm whether this specific technology is in use within our environment and, if so, to what extent.

Attackers can run code over the network.
Database drivers are rarely internet-facing.
Confirm if your systems use this driver.

Attack Path

How an attacker could exploit the issue

A remote attacker could exploit a heap-based buffer overflow vulnerability in the SQL Server ODBC driver to execute arbitrary code over the network. This occurs when the driver processes specially crafted input, which can lead to a denial of service or, in supported configurations, remote code execution.

Network access required.
Specially crafted input triggers overflow.
Risk of remote code execution.

Live Threat

Current exploitation, exposure, and threat context

An attacker could execute arbitrary code over a network by exploiting a heap-based buffer overflow in the SQL Server ODBC driver. This could potentially lead to the compromise of the affected system.

System code execution.
Network-based exploitation.
Unauthorized system access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL Server ODBC driver vulnerability requires immediate attention from teams managing database infrastructure and applications that connect to SQL Server. The first critical step is to identify all instances of the affected driver, determine their network exposure, and ascertain their business criticality. Once these factors are understood, responsible teams can prioritize remediation efforts, coordinating with application owners and potentially the vendor for a planned fix.

Database and application owners should lead remediation.
Verify driver instances and network exposure.
Plan coordinated patching or vendor updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the SQL Server ODBC driver?

It is a middleware component that acts as a bridge, allowing software applications to communicate with and retrieve data from SQL Server databases. It translates application queries into a format the database understands, serving as a foundational interface for many enterprise programs that rely on SQL connectivity to function.

What does heap-based buffer overflow mean for CVE-2026-42990?

This is a memory corruption weakness, classified as CWE-122. It happens when the driver writes more data into a specific area of memory (the heap) than it is designed to hold. In this CVE, an attacker can leverage this mistake to overwrite adjacent memory, which may allow them to run their own malicious code on the system.

How is this memory overflow triggered?

The flaw is triggered when the driver processes specially crafted input. It does not occur during standard database operations; rather, it requires the driver to receive malicious data packets designed to exceed memory boundaries. If the input is well-formed and legitimate, the driver functions as expected.

Is my system at risk if the database is internal?

According to Halo Surface Signal, this vulnerability is unlikely to be reachable if your driver is used for internal database connections, as it is not intended for public internet exposure. The risk is significantly higher if a component using this driver is accidentally or intentionally placed on an internet-facing network path.

What should I do first to address this vulnerability?

Begin by auditing your infrastructure to locate every instance of the SQL Server ODBC driver. Once identified, map these instances to the applications that use them and verify their network connectivity. Focus on determining which systems might have accidental network exposure, then coordinate with application owners to plan for updates once the vendor releases a fix.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42990

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.