VulnSocial

CVE-2026-42990General(microsoft / windows_10_1607)

LOWCVSS 9.8 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch microsoft windows_10_1607 systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network.

microsoft CVEsBack to dashboard
1.0/ 10 priority

Sources & remediation

Patch / fix
Weakness type (CWE)
CWE-122

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • windows_10_1607
  • windows_10_1809
  • windows_10_21h2
  • windows_10_22h2

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • General: 2 classified signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-07-14); latest day: 2
  • 4 total mentions across 2 days

Affected systems

Vendors
microsoft
Products
windows_10_1607windows_10_1809windows_10_21h2windows_10_22h2windows_11_24h2windows_11_25h2windows_11_26h1windows_server_2012windows_server_2016windows_server_2019

2 versions affected across 12 products

Deep dive

Activity timeline4 mentions / 2d
01122Mentions · 2026-07-14: 2Mentions · 2026-07-16: 2Patch / Workaround · 2026-07-14: 1Patch / Workaround · 2026-07-16: 1Technical Details · 2026-07-16: 207-1407-16
Signal classification3 categories
General
250.0%
Disclosure
125.0%
Patch
125.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-07-142
General2
2026-07-162
Disclosure1Patch1
Full discourse4 posts
  • SecAlerts@SecAlertsCo
    Patch

    💾 CVE-2026-42990: Heap buffer overflow in the SQL Server ODBC driver enables network-based elevation of privilege. CVSS 9.8, no auth required. Affects Windows 10/11 and all major Server editions. Patch now. https://secalerts.co/vulnerability/CVE-2026-42990?utm_campaign=x https://t.co/yxdPfjdcXQ

    Post summary

    The post highlights a critical heap buffer overflow in the SQL Server ODBC driver and urges users to apply the patch that is now available.

    00111160
    858 followersView on X
  • TechDirectArchive@TechDArchive
    Disclosure

    https://community.veeam.com/cyber-security-space-95/critical-flaw-in-sql-server-odbc-driver-cve-2026-42990-13695

    Post summary

    The community post announces a critical flaw in the SQL Server ODBC driver (CVE-2026-42990), providing technical details about the vulnerability but offering no PoC, exploit code, active exploitation evidence, or patch information.

    0000010
    652 followersView on X
  • Windows Forum@windowsforum
    General

    🪟 CVE-2026-42990 is a reminder that “we patched SQL Server” means little if vulnerable ODBC drivers are hiding inside apps, agents, and automation jobs. Inventory first, panic efficiently. https://windowsforum.com/threads/cve-2026-42990-inventory-microsoft-odbc-driver-17-and-18.438149/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #SecurityUpdates #PrivilegeEscalation #Cve202642990 https://t.co/O937wEMJuv

    Post summary

    The tweet serves as a general reminder that patching SQL Server alone may not mitigate CVE‑2026‑42990 if vulnerable ODBC drivers remain, urging users to inventory those drivers without detailing exploits or patches.

    0000042
    1.2K followersView on X
  • VulDB 🛡@vuldb
    General

    We have just added an important vulnerability affecting Microsoft SQL Server (CVE-2026-42990) https://vuldb.com/vuln/378415

    Post summary

    The statement briefly announces a newly added CVE for Microsoft SQL Server and links to an external site, but lacks specific technical, exploit, or mitigation details.

    0000099
    2.3K followersView on X
CPE platform detail22 entries

22 of 22 entries

PartVendorProductVersionTarget SWTarget HW
OSmicrosoftwindows_10_1607--x64
OSmicrosoftwindows_10_1607--x86
OSmicrosoftwindows_10_1809--x64
OSmicrosoftwindows_10_1809--x86
OSmicrosoftwindows_10_21h2--arm64
OSmicrosoftwindows_10_21h2--x64
OSmicrosoftwindows_10_21h2--x86
OSmicrosoftwindows_10_22h2--arm64
OSmicrosoftwindows_10_22h2--x64
OSmicrosoftwindows_10_22h2--x86
OSmicrosoftwindows_11_24h2--arm64
OSmicrosoftwindows_11_24h2--x64
OSmicrosoftwindows_11_25h2--arm64
OSmicrosoftwindows_11_25h2--x64
OSmicrosoftwindows_11_26h1--arm64
OSmicrosoftwindows_11_26h1--x64
OSmicrosoftwindows_server_2012---
OSmicrosoftwindows_server_2012r2--
OSmicrosoftwindows_server_2016--x64
OSmicrosoftwindows_server_2019--x64
OSmicrosoftwindows_server_2022--x64
OSmicrosoftwindows_server_2025--x64

Explore more

Back to dashboardmicrosoft CVEswindows_10_1607 vulnerabilities