{"id":"CVE-2026-88222","kind":"vulnerability","aliases":["CVE-2026-88222"],"related":[],"title":"Microsoft WDAC OLE DB provider for SQL: heap overflow allows remote code execution","description":"Heap-based buffer overflow in Microsoft WDAC OLE DB provider for SQL allows an unauthorized attacker to execute code over a network.","summary":"A heap-based buffer overflow in the Microsoft WDAC OLE DB provider for SQL lets an unauthorized attacker run code over the network. The sources give a CVSS score of 8.8 and do not describe the exact trigger.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","ole-db","sql-server","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:21:30+00:00","first_seen_at":"2026-11-10T19:25:19+00:00","triaged_at":"2026-11-10T19:26:00+00:00","updated_at":"2026-11-10T19:26:00+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:26:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft WDAC OLE DB provider for SQL: heap overflow allows remote code execution","impact":"high","summary":"A heap-based buffer overflow in the Microsoft WDAC OLE DB provider for SQL lets an unauthorized attacker run code over the network. The sources give a CVSS score of 8.8 and do not describe the exact trigger.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","sql-server","ole-db"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the affected machine over the network.","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-88222 to get affected versions, the fixed build and any mitigation.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems that use the Microsoft WDAC OLE DB provider for SQL to connect to SQL Server databases are likely in scope. The sources do not say which versions or configurations are affected.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000673,"input_tokens":4514,"output_tokens":444,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-88222 to get affected versions, the fixed build and any mitigation.","search":"'-2026':15A,18A '-88222':16A,19A '8.8':59B 'allow':10A,80C 'attack':46B,83C 'base':31B,69C 'buffer':32B,70C 'code':12A,48B,86C 'cve':14A,17A 'cvss':56B 'db':4A,23B,39B,76C 'describ':63B 'exact':65B 'execut':13A,85C 'give':54B 'heap':8A,30B,68C 'heap-bas':29B,67C 'infrastructur':20B 'let':43B 'microsoft':1A,36B,73C 'network':51B,89C 'ole':3A,22B,38B,75C 'ole-db':21B 'overflow':9A,33B,71C 'provid':5A,40B,77C 'remot':11A 'run':47B 'score':57B 'server':26B 'sourc':53B 'sql':7A,25B,42B,79C 'sql-server':24B 'trigger':66B 'unauthor':45B,82C 'wdac':2A,37B,74C 'window':27B","nicknames":[],"mitigations":[],"who_affected":"Systems that use the Microsoft WDAC OLE DB provider for SQL to connect to SQL Server databases are likely in scope. The sources do not say which versions or configurations are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","oledb","sqlserver","windows"],"campaign_type":null,"search_a":"'-2026':15A,18A '-88222':16A,19A 'allow':10A 'code':12A 'cve':14A,17A 'db':4A 'execut':13A 'heap':8A 'microsoft':1A 'ole':3A 'overflow':9A 'provid':5A 'remot':11A 'sql':7A 'wdac':2A","search_b":"'8.8':59B 'attack':46B 'base':31B 'buffer':32B 'code':48B 'cvss':56B 'db':23B,39B 'describ':63B 'exact':65B 'give':54B 'heap':30B 'heap-bas':29B 'infrastructur':20B 'let':43B 'microsoft':36B 'network':51B 'ole':22B,38B 'ole-db':21B 'overflow':33B 'provid':40B 'run':47B 'score':57B 'server':26B 'sourc':53B 'sql':25B,42B 'sql-server':24B 'trigger':66B 'unauthor':45B 'wdac':37B 'window':27B","search_c":"'allow':80C 'attack':83C 'base':69C 'buffer':70C 'code':86C 'db':76C 'execut':85C 'heap':68C 'heap-bas':67C 'microsoft':73C 'network':89C 'ole':75C 'overflow':71C 'provid':77C 'sql':79C 'unauthor':82C 'wdac':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88222","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88222","severity":null,"published_at":"2026-11-10T19:21:30+00:00","modified_at":"2026-11-10T19:21:30+00:00","first_seen_at":"2026-11-10T19:25:19+00:00","fetched_at":"2026-11-10T19:25:19+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}