Microsoft Windows ODBC Driver: Remote Code Execution via heap-based buffer overflow

Summary

A heap-based buffer overflow (CWE-122) in the Windows ODBC Driver allows an unauthorized attacker to execute code over a network. The CVE record rates it 8.8 (High) and requires user interaction; the likely trigger is a client connecting to an untrusted or attacker-controlled data source. A successful attack could fully compromise confidentiality, integrity and availability on the affected host. As of the sources reviewed, exploitation is not known and NVD had not yet completed its analysis.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9688)
• Windows 10 Version 1809 (builds before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds before 10.0.19045.7846)
• Windows 11 Version 23H2 (builds before 10.0.22631.7711)
• Windows 11 Version 24H2 (builds before 10.0.26100.9974)
• Windows 11 Version 25H2 (builds before 10.0.26200.9974)
• Windows 11 Version 26H1 (builds before 10.0.28000.3501)
• Windows 11 Version 26H2 (builds before 10.0.26300.9974)
• Windows Server 2016, including Server Core (builds before 10.0.14393.9688)
• Windows Server 2019, including Server Core (builds before 10.0.17763.9487)
• Windows Server 2022 (builds before 10.0.20348.5870)

Fixed in

• Fixed builds are listed in the Microsoft Security Update Guide; verify them there before deployment.
• Builds per the CVE record and a third-party aggregator, not yet verified against the MSRC table: 1607 and Server 2016 at 10.0.14393.9688; 1809 and Server 2019 at 10.0.17763.9487; 21H2 at 10.0.19044.7846; 22H2 at 10.0.19045.7846; Windows 11 23H2 at 10.0.22631.7711; Server 2022 at 10.0.20348.5870.
• The record does not list fixed builds for all Windows 11 versions; check the MSRC page.

Workaround

Unknown.

• No vendor or third-party workaround was found. Check the MSRC page for a mitigation section.

Exploitation

• Not known to be exploited as of 10 Nov 2026 (OffSeq).
• CVSS vector carries exploit maturity E:U (unproven).
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept found in searches; CISA KEV status not checked.

Our recommendation

• Inventory hosts with the Windows ODBC driver and applications that use it, such as accounting, ERP and reporting software.
• Apply the Microsoft security update for each affected Windows version, starting with servers and multi-user workstations, and confirm the fixed build on the MSRC page first.
• Restrict client connections to untrusted or external data sources where possible.
• Monitor for proof-of-concept releases and CISA KEV additions and re-prioritise if exploitation is reported.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-108411 www.cve.org
• Microsoft Security Update Guide CVE-2026-108411 msrc.microsoft.com
• Strix CVE-2026-108411 www.strix.ai
• OffSeq threat radar CVE-2026-108411 radar.offseq.com
• VulDB CVE-2026-108411 vuldb.com
• SentinelOne CVE-2023-21732 (analogous ODBC RCE) www.sentinelone.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 23:58.