CVE-2023-36730: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-10-10 · updated 2026-06-17
Weakness: CWE-122

Description

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Affected products

Microsoft Odbc Driver For Sql Server: from 17.0 before 17.10.5.1; from 18.0 before 18.3.2.1 — fixed in 17.10.5.1, 18.3.2.1
Microsoft SQL Server: 2019, 2022
Microsoft ODBC Driver 17 for SQL Server on Linux: from 17.0.0.0 before 17.10.5.1 — fixed in 17.10.5.1
Microsoft ODBC Driver 17 for SQL Server on MacOS: from 17.0.0.0 before 17.10.5.1 — fixed in 17.10.5.1
Microsoft ODBC Driver 17 for SQL Server on Windows: from 17.0.0.0 before 17.10.5.1 — fixed in 17.10.5.1
Microsoft ODBC Driver 18 for SQL Server on Linux: from 18.0.0.0 before 18.3.2.1 — fixed in 18.3.2.1
Microsoft ODBC Driver 18 for SQL Server on MacOS: from 18.0.0.0 before 18.3.2.1 — fixed in 18.3.2.1
Microsoft ODBC Driver 18 for SQL Server on Windows: from 18.0.0.0 before 18.3.2.1 — fixed in 18.3.2.1
Microsoft SQL Server 2019 (CU 22): from 15.0.0 before 15.0.4326.1 — fixed in 15.0.4326.1
Microsoft SQL Server 2019 (GDR): from 15.0.0 before 15.0.2104.1 — fixed in 15.0.2104.1
Microsoft SQL Server 2022 (CU 8): from 15.0.0 before 16.0.4080.1 — fixed in 16.0.4080.1
Microsoft SQL Server 2022 (GDR): from 16.0.0 before 16.0.1105.1 — fixed in 16.0.1105.1

How to fix

Upgrade to a fixed version: Microsoft Odbc Driver For Sql Server 17.10.5.1, 18.3.2.1; Microsoft ODBC Driver 17 for SQL Server on Linux 17.10.5.1; Microsoft ODBC Driver 17 for SQL Server on MacOS 17.10.5.1; Microsoft ODBC Driver 17 for SQL Server on Windows 17.10.5.1; Microsoft ODBC Driver 18 for SQL Server on Linux 18.3.2.1; Microsoft ODBC Driver 18 for SQL Server on MacOS 18.3.2.1; Microsoft ODBC Driver 18 for SQL Server on Windows 18.3.2.1; Microsoft SQL Server 2019 (CU 22) 15.0.4326.1; Microsoft SQL Server 2019 (GDR) 15.0.2104.1; Microsoft SQL Server 2022 (CU 8) 16.0.4080.1; Microsoft SQL Server 2022 (GDR) 16.0.1105.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-36730 or the next vulnerability affects your stack