CVE-2026-72933 in Windows
Summary
by MITRE • 09/09/2026
Heap-based buffer overflow in Microsoft WDAC OLE DB provider for SQL allows an unauthorized attacker to execute code over a network.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified involves a heap-based buffer overflow within the Windows Defender Application Control (WDAC) OLE DB provider for SQL, specifically affecting components responsible for handling data input during database operations. This flaw arises from improper validation of user-supplied data before it is copied into memory buffers allocated on the heap. When an attacker sends specially crafted requests to the affected service over a network, they can trigger this overflow condition by supplying input that exceeds the expected buffer size. The lack of adequate boundary checks allows malicious data to overwrite adjacent memory locations, potentially corrupting critical program structures such as function pointers or exception handlers stored in nearby heap metadata.
From an operational perspective, successful exploitation of this vulnerability grants an unauthorized attacker the ability to execute arbitrary code on the target system with the privileges of the affected process. Since the WDAC OLE DB provider often runs within a service context that may possess elevated permissions, compromising this component can lead to full control over the underlying operating system. This capability enables attackers to install programs, view, change, or delete data, and create new accounts with full user rights. The network-based nature of the attack vector means that remote exploitation is possible without requiring prior authentication in certain configurations, significantly increasing the risk profile for systems exposed to untrusted networks.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-122, which describes a heap-based buffer overflow where data written exceeds the bounds of a preallocated heap region. In terms of cyber kill chain and adversary tactics, this flaw facilitates Initial Access via Exploit Public-Facing Application as defined in MITRE ATT&CK technique T1190, followed by Execution through arbitrary code execution (T1203). The ability to execute code remotely makes it a high-priority target for automated scanning tools and advanced persistent threat actors seeking to establish footholds within enterprise environments.
Mitigation strategies primarily involve applying the latest security patches released by Microsoft to update the WDAC components and associated OLE DB providers. Organizations should ensure that their patch management processes are up to date with all critical updates related to Windows Defender Application Control. Additionally, network segmentation can help limit exposure by restricting access to systems running vulnerable services from untrusted networks. Implementing strict input validation at application boundaries and employing runtime protection mechanisms such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) can also reduce the likelihood of successful exploitation, although patching remains the most effective remediation step for this specific heap overflow condition.