← Vulnerability feed

Vulnerability record · CVE-2002-0695 · published 12 August 2002

CVE-2002-0695: Microsoft data access components vulnerability

Microsoft · Data Access Components

Buffer overflow in the Transact-SQL (T-SQL) OpenRowSet component of Microsoft Data Access Components (MDAC) 2.5 through 2.7 for SQL Server 7.0 or 2000 allows remote attackers to execute arbitrary code via a query that calls the OpenRowSet command.

7.5 CVSS 2.0 High EPSS 17% · top 3.0%
7.5CVSS 2.0 base score
17%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
8References
16 Jun 2026Last modified by NVD

Description

Buffer overflow in the Transact-SQL (T-SQL) OpenRowSet component of Microsoft Data Access Components (MDAC) 2.5 through 2.7 for SQL Server 7.0 or 2000 allows remote attackers to execute arbitrary code via a query that calls the OpenRowSet command.

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.iss.net/security_center/static/9734.php
http://www.nextgenss.com/advisories/mssql-ors.txt
http://www.securityfocus.com/bid/5372
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-040
http://www.iss.net/security_center/static/9734.php
http://www.nextgenss.com/advisories/mssql-ors.txt
http://www.securityfocus.com/bid/5372
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-040

Track CVE-2002-0695 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2003-0903Microsoft data access components memory buffer overflow vulnerabilityBuffer overflow in a component of Microsoft Data Access Components (MDAC) 2.5 through 2.8 allows remote attackers to execute arbitrary code via a mal…EPSS 37%10.0CVE-2002-1918Microsoft data access components vulnerabilityBuffer overflow in Microsoft Active Data Objects (ADO) in Microsoft MDAC 2.5 through 2.7 allows remote attackers to have unknown impact with unknown …EPSS 16%10.0CVE-1999-1011Microsoft MDAC RDS DataFactory unsafe methods allow remote command executionThe Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC), as shipped with IIS 3.x and 4.x, exposes unsafe metho…EPSS 77%analysed9.8CVE-2012-1891Microsoft data access components memory buffer overflow vulnerabilityHeap-based buffer overflow in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2 and Windows Data Access Components (WDAC) 6.0 allows remote att…EPSS 29%9.3CVE-2011-0026Microsoft data access components vulnerabilityInteger signedness error in the SQLConnectW function in an ODBC API (odbc32.dll) in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2, and Wind…EPSS 34%9.3CVE-2011-0027Microsoft MDAC/WDAC ADO Record memory allocation flaw enables remote code executionMicrosoft Data Access Components (MDAC) 2.8 SP1/SP2 and Windows Data Access Components (WDAC) 6.0 fail to properly validate memory allocation for int…EPSS 54%analysed9.3CVE-2006-5559Microsoft data access components improper input validation vulnerabilityThe Execute method in the ADODB.Connection 2.7 and 2.8 ActiveX control objects (ADODB.Connection.2.7 and ADODB.Connection.2.8) in the Microsoft Data …EPSS 44%7.5CVE-2003-0353Microsoft data access components vulnerabilityBuffer overflow in a component of SQL-DMO for Microsoft Data Access Components (MDAC) 2.5 through 2.7 allows remote attackers to execute arbitrary co…EPSS 22%

Source: NIST National Vulnerability Database (record CVE-2002-0695), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.