CVE-2023-23375: Microsoft ODBC and OLE DB Remote Code Execution Vulnerability

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-04-11 · updated 2026-06-17
Weakness: CWE-20

Description

Microsoft ODBC and OLE DB Remote Code Execution Vulnerability

Affected products

Microsoft Odbc: from 17.0 before 17.10.3.1; from 18.0 before 18.2.1.1 — fixed in 17.10.3.1, 18.2.1.1
Microsoft Ole Db: from 18.0 before 18.6.5; from 19.1.0 before 19.3.0 — fixed in 18.6.5, 19.3.0
Microsoft ODBC Driver 17 for SQL Server: from 17.0.0.0 before 17.10.3.1 — fixed in 17.10.3.1
Microsoft ODBC Driver 18 for SQL Server: from 18.0.0.0 before 18.2.1.1 — fixed in 18.2.1.1
Microsoft OLE DB Driver 18 for SQL Server: from 18.0.0 before 18.6.5 — fixed in 18.6.5
Microsoft OLE DB Driver 19 for SQL Server: from 19.0.0 before 19.3.0 — fixed in 19.3.0

How to fix

Upgrade to a fixed version: Microsoft Odbc 17.10.3.1, 18.2.1.1; Microsoft Ole Db 18.6.5, 19.3.0; Microsoft ODBC Driver 17 for SQL Server 17.10.3.1; Microsoft ODBC Driver 18 for SQL Server 18.2.1.1; Microsoft OLE DB Driver 18 for SQL Server 18.6.5; Microsoft OLE DB Driver 19 for SQL Server 19.3.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-23375 or the next vulnerability affects your stack