A heap‑based buffer overflow exists in the Microsoft WDAC OLE DB provider for SQL. When the provider receives specially crafted data over a network, an unauthorized attacker can trigger an out‑of‑bounds write that leads to arbitrary code execution. The vulnerability requires no local privileges; the attacker can execute code with the same rights as the user running the provider, potentially granting full system compromise.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1, 23H2, 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 including Server Core installations.

The flaw carries a CVSS score of 8.8, indicating high severity. EPSS data is unavailable, so the exact likelihood of exploitation is unknown, though the vulnerability is not listed in the CISA KEV catalog. It can be exploited over the network from an unauthenticated attacker, leading to full remote code execution on affected systems.