Overview of CVE-2026-88222: Heap-Based Buffer Overflow in Microsoft WDAC OLE DB Provider for SQL Enables Client-Side Code Execution

Introduction

Microsoft's November 2026 Patch Tuesday closed a heap-based buffer overflow in the WDAC OLE DB provider for SQL that allows a malicious server to execute code on the Windows client that connects to it. Because this provider ships with Windows itself, the exposure follows the operating system on Windows 10, Windows 11, and Windows Server rather than any SQL Server installation, which changes how teams should scope their remediation.

The source CVE record lists the vendor as "Unknown", but the affected component, the advisory, and the CNA assignment all belong to Microsoft.

Technical information

Root cause

Microsoft classifies CVE-2026-88222 as CWE 122, Heap Based Buffer Overflow. MITRE defines this weakness as writing beyond the end of a buffer allocated on the heap, with general consequences that include crashes, memory modification, and arbitrary code execution. For this specific CVE, Microsoft's advisory identifies the outcome as remote code execution.

Despite the word SQL in the component name, Microsoft's FAQ places the trigger on the client processing a server response. The bug is client-side memory corruption, reachable by whoever controls the server the client talks to. It is not an unauthenticated query sent to a legitimate SQL Server instance.

Attack flow

Based on Microsoft's documented exploitation scenario (not an observed intrusion):

1. The attacker hosts a malicious server that speaks to the WDAC OLE DB provider for SQL.
2. The attacker convinces a user to connect to that server from an affected Windows client. This is the user interaction step reflected in the CVSS vector.
3. The affected client receives and processes the server's response.
4. Processing that response overflows a heap buffer in the provider, and the attacker could execute code on the client system.

CVSS context

Microsoft supplied the following base vector, recorded in NVD:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack vector: Network
• Attack complexity: Low
• Privileges required: None
• User interaction: Required
• Scope: Unchanged
• Confidentiality, Integrity, Availability: High

The base score is 8.8 (High), the temporal score is 7.7, and Microsoft's own advisory severity is Important. The temporal vector includes E:U (unproven exploit maturity) and a Remediation Level of Official Fix. Low attack complexity does not remove the user interaction requirement, so this should not be described as an interaction-free attack against any reachable SQL service.

NVD shows the record as Awaiting Analysis (published 2026-11-10T19:21:30.117, modified 2026-11-10T21:21:38.020), so the available score is Microsoft's CNA assessment rather than an independent NVD score. The record also carries a CISA coordinator SSVC assessment: exploitation none, automatable no, technical impact total.

Which provider is affected

Microsoft documents SQLOLEDB as the provider shipped with Windows Data Access Components, notes that it is no longer maintained, and says it is not recommended for new development. Microsoft separately recommends its newer OLE DB Driver for SQL Server, including MSOLEDBSQL19. These statements distinguish the two product families. They do not establish that switching drivers fixes this CVE.

What is not disclosed

Windows is closed source, and Microsoft has not published a diff, commit, or file-level change notes. The reviewed records do not identify the vulnerable function, the specific response field, the allocation size, the overwrite length, or the privilege level of resulting code execution. From the bug class and the documented trigger, the most likely fix is stricter length and bounds checking where the client copies server-supplied response data into heap buffers. Treat that as informed inference, not vendor-confirmed detail.

Exploitation status

At release, Microsoft marked the flaw Publicly disclosed: No, Exploited: No, and Exploitation Less Likely. Senserva reports it is not listed in CISA KEV, and no named threat actor, campaign, or verified public proof of concept was identified in the reviewed reporting. Discovery is credited anonymously. Rapid7's November review names a different bug, the Outlook spoofing vulnerability CVE-2026-124194, as the month's actively exploited issue. That finding should not be applied to this WDAC provider vulnerability.

Patch information

How the fix ships. Microsoft closed CVE-2026-88222 on November 10, 2026. There is no separate download for the WDAC OLE DB provider for SQL. The fix is included in the regular monthly Windows cumulative security update for each supported version, so installing that month's update replaces the vulnerable provider code. The advisory documents no specific workaround.

Fixed builds by product. A system is fixed once its OS build is at or above the listed level:

• Windows 10 1607 / Server 2016 (incl. Server Core): KB5131291, build 10.0.14393.9688
• Windows 10 1809 / Server 2019 (incl. Server Core): KB5131085, build 10.0.17763.9487
• Windows 10 21H2: KB5131096, build 10.0.19044.7846
• Windows 10 22H2: KB5131096, build 10.0.19045.7846
• Windows Server 2022 (incl. Server Core): KB5131090, build 10.0.20348.5870
• Windows 11 23H2: KB5131087, build 10.0.22631.7711
• Windows 11 24H2: KB5132061 / KB5132043, builds 10.0.26100.9974 / .9911
• Windows 11 25H2: KB5132061 / KB5132043, builds 10.0.26200.9974 / .9911
• Windows 11 26H2: KB5132061 / KB5132043, builds 10.0.26300.9974 / .9911
• Windows 11 26H1: KB5132059, build 10.0.28000.3501
• Windows Server 2025 (incl. Server Core): KB5131080 / KB5131077, builds 10.0.26100.33822 / .33730

Paired packages need a closer look. For Windows 11 24H2, 25H2, 26H2 and Windows Server 2025, MSRC lists two KBs, and therefore two builds, for the same product. The advisory does not explain why. NVD's affected version data uses the higher build as the cutoff. For example, Server 2025 is listed as affected below 10.0.26100.33822. Meanwhile, third-party KB trackers still list CVE-2026-88222 among the CVEs fixed by KB5131077 (Server 2025) and KB5131291 (Server 2016). On these products, confirm which package your servicing channel delivers and whether the resulting build meets the threshold, rather than assuming either KB number is sufficient on its own.

Installation prerequisites.

• Windows Server 2025, KB5131080: requires servicing stack update version 26100.33822 or later. Delivery channels include Windows Update, Microsoft Update Catalog, and WSUS.
• Windows 10 21H2 and 22H2, KB5131096: requires an update released on or after July 8, 2025 (such as KB5062554) and servicing stack version 19044.6088 or later. Offline servicing of images lacking the July 25, 2023 cumulative update or later has an additional condition. The article covers Windows 10 ESU and applicable LTSC editions, so applicability cannot be inferred from version number alone.

Related fixes in the same update. This is one of five WDAC OLE DB provider for SQL RCEs fixed in the November release. The others are CVE-2026-85838, CVE-2026-85839, CVE-2026-116698 and CVE-2026-116699. Since they share the same cumulative update, one install closes all five.

Checking a host. Microsoft publishes no file-level fixed version, so the reliable check is to compare the OS build number (for example via winver or your endpoint management tool) against the list above, or to confirm the matching KB is installed.

What is not a substitute. Migrating applications from SQLOLEDB to MSOLEDBSQL19 is product lifecycle guidance, and MITRE's bounds-checking recommendations are developer prevention measures for the weakness class. Neither repairs the shipped Windows binary. The cumulative update does.

Affected systems and versions

Affected systems are Windows installations whose OS build is below the fixed build for their product and servicing branch:

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds below 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds below 10.0.17763.9487
• Windows 10 Version 21H2: builds below 10.0.19044.7846
• Windows 10 Version 22H2: builds below 10.0.19045.7846
• Windows Server 2022 (including Server Core): builds below 10.0.20348.5870
• Windows 11 Version 23H2: builds below 10.0.22631.7711
• Windows 11 Version 24H2: builds below 10.0.26100.9974 per NVD (MSRC also lists 10.0.26100.9911 via KB5132043)
• Windows 11 Version 25H2: builds below 10.0.26200.9974 per NVD (MSRC also lists 10.0.26200.9911)
• Windows 11 Version 26H2: builds below 10.0.26300.9974 per NVD (MSRC also lists 10.0.26300.9911)
• Windows 11 Version 26H1: builds below 10.0.28000.3501
• Windows Server 2025 (including Server Core): builds below 10.0.26100.33822 per NVD (MSRC also lists 10.0.26100.33730 via KB5131077)

The exposed configuration is an affected Windows client that uses the WDAC OLE DB provider for SQL to connect to a server. Architecture and Server Core applicability should follow the corresponding MSRC advisory entry.

Vendor security history

Microsoft's broad footprint is well documented. In its review of the Summer 2023 Exchange Online intrusion, the Cyber Safety Review Board described Microsoft products as ubiquitous and critical to essential services, including national security, economic activity, and public health and safety. The Board found that a group associated with the government of the People's Republic of China compromised Microsoft's cloud environment and accessed email accounts of senior United States officials. It concluded the intrusion was preventable and resulted from a cascade of security failures, and it found Microsoft's security culture inadequate. One concrete finding concerned key lifecycle management: continued manual rotation, completed automated rotation, or alerting on aging keys would have prevented a 2016 signing key from remaining valid in 2023.

Microsoft's July 2026 Secure Future Initiative report describes corrective investment, including retiring the remaining classic Azure Service Manager model and reporting that build-time network isolation prevented 83% of pipelines from accessing unapproved package endpoints, Linux packages, and mirrors. These are vendor-reported results, not an independent assurance opinion on the WDAC provider, and none of this history indicates that CVE-2026-88222 has been exploited.

References

• NVD entry for CVE-2026-88222
• CVE.org record for CVE-2026-88222
• Microsoft Security Update Guide advisory
• NVD API record (JSON)
• Rapid7: Patch Tuesday, November 2026
• Zero Day Initiative: The November 2026 Security Update Review
• Senserva: KB5131291
• Senserva: KB5131077
• Senserva: CVE-2026-88222
• Casco: CVE-2026-88222
• Microsoft Support: KB5131096
• Microsoft Support: KB5131080
• Microsoft Support: KB5132061
• Microsoft Learn: OLE DB Driver for SQL Server
• MITRE CWE 122: Heap Based Buffer Overflow
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft Secure Future Initiative Report, July 2026