Microsoft WDAC OLE DB provider for SQL: Heap-based buffer overflow allows code execution

Summary

The Windows Data Access Components (WDAC) OLE DB provider for SQL Server, used by Windows applications to communicate with SQL Server databases, contains a heap-based buffer overflow (CWE-122). An unauthorized attacker can execute code over the network with a CVSS score of 8.8. Based on the research notes, exploitation likely requires that a user connects to a malicious or attacker-controlled SQL endpoint, which matches the user interaction flag in the vector; this trigger is not confirmed for this CVE.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2012 (including Server Core): 6.2.9200.0 to before 6.2.9200.26434
• Windows Server 2012 R2 (including Server Core): 6.3.9600.0 to before 6.3.9600.23470
• Windows Server 2016: 10.0.14393.0 to before 10.0.14393.9612

Fixed in

• Fixed builds per the CVE record ranges above; the cumulative update for each Windows build is listed in the Microsoft advisory.
• Fixed builds reported by a third-party aggregator (unverified): Windows 10 1809 10.0.17763.9376, 21H2 10.0.19044.7807, 22H2 10.0.19045.7807, Windows 11 23H2 10.0.22631.7652.

Workaround

Unknown. No official workaround was found. Until patched, limit which clients connect to untrusted SQL endpoints and restrict outbound database connections from workstations and servers.

Exploitation

• No evidence of exploitation in the wild as of 10 November 2026 (third-party source).
• No public proof-of-concept found.
• Listed in Microsoft's November 2026 Patch Tuesday as Important, impact Remote Code Execution.

Our recommendation

• Apply the November 2026 security update to all affected Windows clients and servers, prioritising hosts that connect to external SQL servers.
• Verify the fixed build against the Microsoft Security Update Guide, as third-party build data is unconfirmed.
• Check whether legacy systems such as Windows 10 1607 and Windows Server 2012 are still supported or covered by Extended Security Updates.
• Restrict outbound SQL connections from workstations and monitor for connections to unknown database endpoints.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide (CVE-2026-85838) msrc.microsoft.com
• Patch Tuesday coverage, November 2026 cybersecuritynews.com
• OffSeq threat radar (third-party, machine-generated) radar.offseq.com
• SentinelOne: CVE-2024-21359 (component context) www.sentinelone.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 20:59.