CVE-2011-0026

critical Microsoft
CVSS v3 Base Score
9.3
AV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS Score
64.3%
Exploitation probability in 30 days
Top 2% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
M
Confidentiality
C
Integrity
C
Availability
C
Published: January 12, 2011 (5602 days ago)
Last Modified: April 29, 2026
Vendor: Microsoft
Source: NVD

Description

Integer signedness error in the SQLConnectW function in an ODBC API (odbc32.dll) in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2, and Windows Data Access Components (WDAC) 6.0, allows remote attackers to execute arbitrary code via a long string in the Data Source Name (DSN) and a crafted szDSN argument, which bypasses a signed comparison and leads to a buffer overflow, aka "DSN Overflow Vulnerability."

CWE

CWE-189

Affected Products

microsoft data access componentsmicrosoft windows data access components

References

🔗 osvdb.org 🔗 secunia.com 🔗 support.avaya.com 🔗 www.securityfocus.com 🔗 www.securitytracker.com