{"id":"CVE-2023-23375","state":"PUBLISHED","title":"Microsoft ODBC and OLE DB Remote Code Execution Vulnerability","description":"Microsoft ODBC and OLE DB Remote Code Execution Vulnerability","publishedAt":"2023-04-11T19:13:25.624Z","updatedAt":"2026-06-02T15:06:17.306Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","source":"microsoft"},"assigner":"microsoft","products":["Microsoft Microsoft OLE DB Driver 18 for SQL Server","Microsoft Microsoft OLE DB Driver 19 for SQL Server","Microsoft Microsoft ODBC Driver 17 for SQL Server","Microsoft Microsoft ODBC Driver 18 for SQL Server"],"affected":[{"vendor":"Microsoft","product":"Microsoft OLE DB Driver 18 for SQL Server","versions":[{"version":"18.0.0","status":"affected","lessThan":"18.6.5","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft OLE DB Driver 19 for SQL Server","versions":[{"version":"19.0.0","status":"affected","lessThan":"19.3.0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft ODBC Driver 17 for SQL Server","versions":[{"version":"17.0.0.0","status":"affected","lessThan":"17.10.3.1","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft ODBC Driver 18 for SQL Server","versions":[{"version":"18.0.0.0","status":"affected","lessThan":"18.2.1.1","versionType":"custom"}],"platforms":["Unknown"]}],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23375"],"weaknesses":["CWE-20"],"ingestedAt":"2026-10-29T20:05:43.909Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/23xxx/CVE-2023-23375.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-23375","state":"PUBLISHED","datePublished":"2023-04-11T19:13:25.624Z","dateUpdated":"2026-06-02T15:06:17.306Z","assignerShortName":"microsoft","assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateReserved":"2023-01-11T22:08:03.133Z"},"containers":{"cna":{"title":"Microsoft ODBC and OLE DB Remote Code Execution Vulnerability","descriptions":[{"lang":"en-US","value":"Microsoft ODBC and OLE DB Remote Code Execution Vulnerability"}],"affected":[{"vendor":"Microsoft","product":"Microsoft OLE DB Driver 18 for SQL Server","versions":[{"version":"18.0.0","status":"affected","lessThan":"18.6.5","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft OLE DB Driver 19 for SQL Server","versions":[{"version":"19.0.0","status":"affected","lessThan":"19.3.0","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft ODBC Driver 17 for SQL Server","versions":[{"version":"17.0.0.0","status":"affected","lessThan":"17.10.3.1","versionType":"custom"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft ODBC Driver 18 for SQL Server","versions":[{"version":"18.0.0.0","status":"affected","lessThan":"18.2.1.1","versionType":"custom"}],"platforms":["Unknown"]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23375","name":"Microsoft ODBC and OLE DB Remote Code Execution Vulnerability","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","baseSeverity":"HIGH","baseScore":7.8,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"CWE-20: Improper Input Validation","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"shortName":"microsoft","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateUpdated":"2025-01-23T01:04:32.536Z"},"datePublic":"2023-04-11T07:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:ole_db_driver_18_for_sql_server:*:*:*:*:*:*:*:*","versionStartIncluding":"18.0.0","versionEndExcluding":"18.6.5"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:ole_db_driver_19_for_sql_server:*:*:*:*:*:*:*:*","versionStartIncluding":"19.0.0","versionEndExcluding":"19.3.0"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:odbc_driver_17_for_sql_server:*:*:*:*:*:*:*:*","versionStartIncluding":"17.0.0.0","versionEndExcluding":"17.10.3.1"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:odbc_driver_18_for_sql_server:*:*:*:*:*:*:*:*","versionStartIncluding":"18.0.0.0","versionEndExcluding":"18.2.1.1"}]}]}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23375","name":"Microsoft ODBC and OLE DB Remote Code Execution Vulnerability","tags":["vendor-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T10:28:40.815Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-06-03T19:22:09.807119Z","id":"CVE-2023-23375","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-02T15:06:17.306Z"}}]}}}