Microsoft WDAC OLE DB provider for SQL: Heap-based buffer overflow

Summary

A heap-based buffer overflow (CWE-122) in the Microsoft WDAC OLE DB provider for SQL allows an unauthorized attacker to execute code over a network. The CVSS 3.1 base score is 8.8. Per the vector, exploitation needs no privileges but requires user interaction, so it is most likely to reach systems through client workstations or applications that connect to SQL databases. NVD had not yet completed its analysis at the time of writing.

Affected

• Windows 10 Version 1607 (builds 10.0.14393.0 to < 10.0.14393.9612)
• Windows 10 Version 1809 (builds 10.0.17763.0 to < 10.0.17763.9376)
• Windows 10 Version 21H2 (builds 10.0.19044.0 to < 10.0.19044.7807)
• Windows 10 Version 22H2 (builds 10.0.19045.0 to < 10.0.19045.7807)
• Windows 11 Version 23H2 (builds 10.0.22631.0 to < 10.0.22631.7652)
• Windows 11 Version 24H2 (builds 10.0.26100.0 to < 10.0.26100.9711)
• Windows 11 Version 25H2 (builds 10.0.26200.0 to < 10.0.26200.9711)
• Windows 11 Version 26H1 (builds 10.0.28000.0 to < 10.0.28000.3231)
• Windows 11 Version 26H2 (builds 10.0.26300.0 to < 10.0.26300.9711)
• Windows Server 2012 incl. Server Core (builds 6.2.9200.0 to < 6.2.9200.26434)
• Windows Server 2012 R2 incl. Server Core (builds 6.3.9600.0 to < 6.3.9600.23470)
• Windows Server 2016 (builds 10.0.14393.0 to < 10.0.14393.9612)

Fixed in

• The CVE record lists the first unaffected build for each product, for example 10.0.14393.9612 for Windows 10 1607 and Server 2016, and 10.0.26100.9711 for Windows 11 24H2.
• Windows 10 1607 and Server 2016 are considered for patching only as far as Microsoft still provides updates.
• The KB numbers were not verified. Check the MSRC advisory for the exact updates.

Workaround

Unknown. No workaround was found in the sources. Until a patch is installed, limit which hosts can reach SQL-connected applications and isolate legacy systems. Confirm any measure against the MSRC guidance.

Exploitation

• Not known to be exploited, according to a single machine-generated aggregator summary.
• No public proof of concept was found at the time of writing.
• This status is not confirmed by the vendor or CISA KEV.

Our recommendation

• Check the MSRC advisory and record the affected builds and KB numbers.
• Inventory all Windows hosts, especially Windows 10 1607 and Server 2016, that run SQL-connected software. Treat these as high priority.
• Install the vendor update as soon as it is available for your build. Replace systems that no longer receive updates.
• Restrict network access to database services and limit untrusted data sources.
• Monitor NVD, CISA KEV and the MSRC page for changes, since the record is new.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-85839 msrc.microsoft.com
• OffSeq: CVE-2026-85839 (secondary, machine-generated) radar.offseq.com
• Vulners: CVE-2026-72933 (related sibling CVE, secondary) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 21:01.