Overview of CVE-2026-85839: Heap Buffer Overflow in Microsoft WDAC OLE DB Provider for SQL Enables Client-Side Code Execution

Introduction

A single connection from a Windows client to the wrong SQL endpoint is enough for an attacker to run code on that client, provided they can persuade a user to make the connection. Microsoft's November 10, 2026 updates fix exactly this scenario in the WDAC OLE DB provider for SQL. That data access component ships inside Windows itself, so the exposure follows Windows installations rather than SQL Server deployments.

A short note on naming, since the acronym is overloaded: here WDAC means Windows Data Access Components, not the Windows Defender Application Control policy feature. Microsoft documents the legacy SQL Server provider in this package under the provider string SQLOLEDB, and OLE DB itself is a set of COM interfaces that gives applications uniform access to diverse data sources. That places the vulnerable code in the application connectivity path on clients and servers alike, wherever software uses this provider to talk to a SQL backend.

Microsoft rates CVE-2026-85839 as Important, with a CVSS v3.1 base score of 8.8 (High) and a temporal score of 7.7. At publication, Microsoft reported it as not exploited and not publicly disclosed, with an assessment of Exploitation Less Likely.

Technical information

Root cause

Microsoft classifies the bug as CWE-122, heap-based buffer overflow. MITRE defines this weakness as writing beyond the end of a buffer allocated on the heap. Documented consequences for the class include crashes, memory modification and arbitrary code execution; overwriting function pointers is one generic way such corruption redirects execution. Those are properties of the weakness class, not a published reconstruction of this specific defect.

Microsoft has not published a diff, symbols or a technical write-up. The public disclosures we reviewed do not identify the vulnerable function, source file, response field, allocation size calculation, payload structure or corruption offset. Patches for this kind of bug typically validate lengths and counts supplied by the server before the provider copies that data into a heap buffer, but treat that as an informed expectation, not a confirmed description of this fix. We are deliberately not borrowing root cause details from other SQL-related overflows just because they share a weakness class.

Where the code actually executes

The short CVE description says the flaw "allows an unauthorized attacker to execute code over a network." The MSRC FAQ makes clear that the client is the execution target. The attacker hosts a malicious server, and the overflow is triggered when an affected client processes that server's response. The advisory does not describe a separate attack in which someone compromises a legitimate SQL Server by sending it a crafted query.

Attack flow

Based on Microsoft's documented scenario:

1. The attacker stands up a malicious server under their control.
2. The attacker persuades a user to connect to that server from a system with an affected WDAC OLE DB provider for SQL. Microsoft explicitly states that user interaction is required.
3. The client connects and the provider processes the server's response.
4. Attacker-controlled data in that response triggers a heap buffer overflow in the provider.
5. The attacker can execute code on the client system.

The disclosures do not establish the privilege level of the resulting code execution or a reliable exploit sequence beyond this outline.

Reading the CVSS vector correctly

Microsoft's full vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• AV:N, AC:L: network delivered, low complexity in Microsoft's assessment.
• PR:N: the attacker needs no privileges on the target.
• UI:R: a user must act, specifically by connecting to the attacker's server. No attacker privileges is not the same thing as no user action.
• S:U: scope unchanged.
• C:H, I:H, A:H: high potential impact to confidentiality, integrity and availability.
• E:U, RL:O, RC:C: exploit maturity Unproven, Official Fix available, report confidence Confirmed. These bring the base 8.8 down to a temporal 7.7.

The 8.8 is Microsoft's CNA score. NVD has not published an independent NIST score and lists the record as awaiting enrichment.

Exploitation status

• At publication, Microsoft listed Publicly disclosed as No and Exploited as No, with an assessment of Exploitation Less Likely.
• TheHackerWire reports no confirmed public exploit code and an EPSS evaluation still in progress.
• TheHackerWire and cve.now both report no CISA KEV entry.
• Microsoft credits bee13oy and thunderj with jd.com under coordinated vulnerability disclosure. These are researcher acknowledgments, not threat actor attribution.

No campaign, actor, victim set, infrastructure or indicators are documented for this CVE. The accurate summary is high potential impact, a real user interaction prerequisite, and no confirmed exploitation in the available reporting.

Patch information

Microsoft fixed CVE-2026-85839 in its November 10, 2026 Patch Tuesday release. Because the WDAC OLE DB provider for SQL ships as part of Windows, there is no separate driver or SQL Server package to install. The fix arrives in each supported Windows release's monthly cumulative or security update. There is no configuration-based fix. Only the updated binaries close the issue.

A system is fixed once it runs the build listed below or a later one. NVD's affected ranges, sourced from Microsoft's CNA data, mark every build below these numbers as vulnerable.

• Windows 11 26H2 (x64/ARM64): KB5127648, fixed build 10.0.26300.9711
• Windows 11 26H1 (x64/ARM64): KB5127646, fixed build 10.0.28000.3231
• Windows 11 25H2 (x64/ARM64): KB5127648, fixed build 10.0.26200.9711
• Windows 11 24H2 (x64/ARM64): KB5127648, fixed build 10.0.26100.9711
• Windows 11 23H2 (x64/ARM64): KB5126653, fixed build 10.0.22631.7652
• Windows 10 22H2 (x86/x64/ARM64): KB5126657, fixed build 10.0.19045.7807
• Windows 10 21H2 (x86/x64/ARM64): KB5126657, fixed build 10.0.19044.7807
• Windows 10 1809 / Server 2019 (incl. Core): KB5126651, fixed build 10.0.17763.9376
• Windows 10 1607 / Server 2016 (incl. Core): KB5126868, fixed build 10.0.14393.9612
• Windows Server 2025 (incl. Core): KB5126646, fixed build 10.0.26100.33650
• Windows Server 2022 (incl. Core): KB5126655, fixed build 10.0.20348.5761
• Windows Server 2012 R2 (incl. Core): KB5126836, fixed build 6.3.9600.23470
• Windows Server 2012 (incl. Core): KB5126835, fixed build 6.2.9200.26434

Notes on these packages:

• Windows 11 24H2, 25H2 and 26H2 share KB5127648, and Windows 10 21H2 and 22H2 share KB5126657.
• Windows Server 2025 is in the same 26100 build family as Windows 11 24H2, but it gets its own KB with a much higher revision (33650). Do not use one platform's build number to judge another platform's patch status.
• Microsoft's support page for KB5127648 and its Windows 11 release information associate builds ending in .9711 with an October 13, 2026 date, while this advisory was released on November 10, 2026. The available sources do not explain that relationship, so select packages from the applicable product entry on the MSRC advisory rather than relying on a matching build number alone.
• All packages are available from the Microsoft Update Catalog via the links on the MSRC advisory.

Verifying installation. Confirm that the OS build and revision (UBR) match or exceed the fixed build. You can read this with winver or from CurrentBuild plus UBR under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion. Microsoft has not published reboot exceptions or known issues specific to this CVE. The usual cumulative update reboot applies.

One update covers the whole WDAC OLE DB group. CVE-2026-85839 is one of five Microsoft WDAC OLE DB provider for SQL Remote Code Execution CVEs released the same day, alongside CVE-2026-85838, CVE-2026-88222, CVE-2026-116698 and CVE-2026-116699. Rapid7 and ZDI list them together in their November reviews. Since the fixes ship in the OS cumulative update, installing the November update for your platform should address all five. Confirm this against each CVE's own MSRC page.

Lifecycle note. Rapid7 notes that Windows 11 23H2 Enterprise, Education and IoT reach end of servicing on November 11, 2026, making KB5126653 one of the last fixes those editions will receive. Plan to move them to a supported release.

What does not substitute for the patch. Microsoft's driver documentation calls SQLOLEDB no longer maintained and recommends MSOLEDBSQL19 for new and existing applications, while another Microsoft article permits mature applications without new SQL Server feature requirements to keep using WDAC. Neither establishes provider migration as the fix for this CVE, so treat modernization as a separate workstream. Likewise, generic heap hardening and monitoring are useful context but are not equivalent remediation.

Affected systems and versions

NVD reproduces the following ranges from Microsoft's CNA data. The lower bound is included and the upper bound is excluded, so any build at or above the upper bound is not affected.

• Windows 10 Version 1607: 10.0.14393.0 up to, but not including, 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 up to, but not including, 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 up to, but not including, 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 up to, but not including, 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 up to, but not including, 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 up to, but not including, 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 up to, but not including, 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 up to, but not including, 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 up to, but not including, 10.0.26300.9711
• Windows Server 2012: 6.2.9200.0 up to, but not including, 6.2.9200.26434
• Windows Server 2012 R2: 6.3.9600.0 up to, but not including, 6.3.9600.23470
• Windows Server 2016: 10.0.14393.0 up to, but not including, 10.0.14393.9612
• Windows Server 2019: 10.0.17763.0 up to, but not including, 10.0.17763.9376
• Windows Server 2022: 10.0.20348.0 up to, but not including, 10.0.20348.5761
• Windows Server 2025: 10.0.26100.0 up to, but not including, 10.0.26100.33650

The CVE record also lists separate ARM64 and x64 entries for Windows 11 Version 23H2 and Server Core entries for several Server releases. This consolidated list does not replace the architecture-specific product entries in the advisory.

The vulnerable configuration is any of these systems acting as a client that connects, through the WDAC OLE DB provider for SQL, to a server an attacker controls. Remediation scope should therefore include workstations and servers that run client applications using this provider, not only hosts running SQL Server.

Vendor security history

This is not the first WDAC OLE DB provider issue built around a malicious server and a connecting client:

• CVE-2023-36006 (December 12, 2023): a stack buffer overflow (CWE-121). Microsoft described persuading an authenticated victim to connect to a malicious SQL database using a SQL client application, with execution in the client application's context, and shipped Windows security updates.
• CVE-2024-21361 (published February 13, 2024): a heap buffer overflow (CWE-122) leading to remote code execution, with a Microsoft CNA base score of 8.8.
• The Zero Day Initiative's February 2024 review described WDAC OLE DB vulnerabilities that required affected clients to connect to a malicious SQL Server and noted the role of social engineering.

The recurring pattern is useful context for threat modeling the provider, but the differing weakness classes are a reminder that similar product names do not imply the same implementation defect or a reusable exploit. With five WDAC OLE DB RCE CVEs landing in November 2026 alone, this component has a continuing history of disclosures and vendor fixes.

References

• MSRC Security Update Guide: CVE-2026-85839
• NVD: CVE-2026-85839
• CVE Record: CVE-2026-85839
• Rapid7: Patch Tuesday, November 2026
• Zero Day Initiative: The November 2026 Security Update Review
• MITRE CWE-122: Heap Based Buffer Overflow
• TheHackerWire: CVE-2026-85839 Analysis
• cve.now: CVE-2026-85839
• Microsoft Support: KB5127648 (OS Builds 26300.9711, 26200.9711 and 26100.9711)
• Microsoft Learn: Windows 11 release information
• Microsoft Learn: OLE DB providers
• Microsoft Learn: When to Use OLE DB Driver
• Microsoft Learn: Microsoft OLE DB Driver for SQL Server
• MSRC Security Update Guide: CVE-2023-36006
• NVD: CVE-2024-21361
• Zero Day Initiative: The February 2024 Security Update Review