{"id":"CVE-2026-108411","kind":"vulnerability","aliases":["CVE-2026-108411"],"related":[],"title":"Windows ODBC Driver: heap overflow lets a network attacker run code","description":"Heap-based buffer overflow in Windows ODBC Driver allows an unauthorized attacker to execute code over a network.","summary":"A heap-based buffer overflow in the Windows ODBC Driver lets an unauthorized attacker send crafted input over a network. A successful attack can execute code on the affected machine.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","odbc","windows"],"not_affected_if":["no-odbc-use"],"how_to_check":"- Check the installed ODBC driver version on Windows machines that run ODBC connections, for example via the driver's file properties in `C:\\Windows\\System32`.\n- Compare the result with the fixed build from Microsoft's security update guide for CVE-2026-108411.","fix":null,"status":"open","published_at":"2026-11-10T19:18:11+00:00","first_seen_at":"2026-11-10T19:24:22+00:00","triaged_at":"2026-11-10T19:34:02+00:00","updated_at":"2026-11-10T19:34:02+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:34:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows ODBC Driver: heap overflow lets a network attacker run code","impact":"high","summary":"A heap-based buffer overflow in the Windows ODBC Driver lets an unauthorized attacker send crafted input over a network. A successful attack can execute code on the affected machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","odbc"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"code runs on the affected Windows machine over the network","analyst_note":"Confirm affected Windows builds, the fixed update, and whether exploitation needs a specific ODBC configuration, from Microsoft's security update guide for CVE-2026-108411.","how_to_check":"- Check the installed ODBC driver version on Windows machines that run ODBC connections, for example via the driver's file properties in `C:\\Windows\\System32`.\n- Compare the result with the fixed build from Microsoft's security update guide for CVE-2026-108411.\n- unknown: the sources do not list affected builds.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-odbc-use"],"who_is_affected":"Windows systems that use the ODBC driver and accept network-reachable connections or input handled by it. The sources do not list affected builds or which ODBC configurations are exposed. Systems that do not use ODBC on Windows are likely not affected, but the sources do not confirm this.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00073,"input_tokens":4496,"output_tokens":560,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Confirm affected Windows builds, the fixed update, and whether exploitation needs a specific ODBC configuration, from Microsoft's security update guide for CVE-2026-108411.","search":"'-108411':14A,17A '-2026':13A,16A 'affect':50B 'allow':61C 'attack':9A,35B,44B,64C 'base':24B,54C 'buffer':25B,55C 'code':11A,47B,67C 'craft':37B 'cve':12A,15A 'driver':3A,31B,60C 'execut':46B,66C 'heap':4A,23B,53C 'heap-bas':22B,52C 'infrastructur':18B 'input':38B 'let':6A,32B 'machin':51B 'network':8A,41B,70C 'odbc':2A,19B,30B,59C 'overflow':5A,26B,56C 'run':10A 'send':36B 'success':43B 'unauthor':34B,63C 'window':1A,20B,29B,58C","nicknames":[],"mitigations":[],"who_affected":"Windows systems that use the ODBC driver and accept network-reachable connections or input handled by it. The sources do not list affected builds or which ODBC configurations are exposed. Systems that do not use ODBC on Windows are likely not affected, but the sources do not confirm this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","odbc","windows"],"campaign_type":null,"search_a":"'-108411':14A,17A '-2026':13A,16A 'attack':9A 'code':11A 'cve':12A,15A 'driver':3A 'heap':4A 'let':6A 'network':8A 'odbc':2A 'overflow':5A 'run':10A 'window':1A","search_b":"'affect':50B 'attack':35B,44B 'base':24B 'buffer':25B 'code':47B 'craft':37B 'driver':31B 'execut':46B 'heap':23B 'heap-bas':22B 'infrastructur':18B 'input':38B 'let':32B 'machin':51B 'network':41B 'odbc':19B,30B 'overflow':26B 'send':36B 'success':43B 'unauthor':34B 'window':20B,29B","search_c":"'allow':61C 'attack':64C 'base':54C 'buffer':55C 'code':67C 'driver':60C 'execut':66C 'heap':53C 'heap-bas':52C 'network':70C 'odbc':59C 'overflow':56C 'unauthor':63C 'window':58C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108411","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108411","severity":null,"published_at":"2026-11-10T19:18:11+00:00","modified_at":"2026-11-10T19:18:11+00:00","first_seen_at":"2026-11-10T19:24:22+00:00","fetched_at":"2026-11-10T19:24:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}