CVE-2007-4814: Microsoft SQL Server Enterprise Manager ActiveX control buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote unauthenticated code execution with public exploit code and a high EPSS score, though exploitation requires the victim to load malicious content and the product is legacy.

What it is

The SQLServer ActiveX control in the Distributed Management Objects OLE DLL (sqldmo.dll) 2000.085.2004.00 shipped with Microsoft SQL Server Enterprise Manager 8.05.2004 contains a buffer overflow. A long second argument to the Start method overflows memory and can lead to arbitrary code execution. The record does not list affected SQL Server versions beyond the DLL build named in the description.

Impact

An attacker who can invoke the control can execute arbitrary code in the context of the process hosting it, typically the user's browser or management console. That yields code execution with the privileges of the logged-on user.

Attack surface

The vector is network-reachable with no authentication (AV:N/AC:L/Au:N), consistent with a web page or other remote content instantiating the ActiveX control. Exploitation requires the victim to load attacker-controlled content that calls the Start method, so user interaction is effectively required even though the CVSS vector does not encode it.

Exploitation

CISA KEV does not list this CVE, but EPSS is high at 0.4571 (98.7th percentile) and public exploit code exists, with Exploit-DB entries 4379 and 4398 and a SecurityFocus reference tagged Exploit. No ransomware group is documented as using it.

What to do

• Apply the Microsoft patch or supported update for the affected SQL Server Enterprise Manager / sqldmo.dll build; if none is available, upgrade to a supported SQL Server release.
• Disable or remove the SQLServer ActiveX control and block its CLSID from instantiating in Internet Explorer via the kill-bit registry setting.
• Restrict Enterprise Manager and DMO usage to trusted administrative hosts and do not browse untrusted sites from systems where the control is installed.
• Enforce least privilege so users running the control do not hold administrative rights, limiting the impact of successful code execution.

Detection

• Monitor for processes loading sqldmo.dll outside expected administrative use, especially browser processes.
• Alert on registry changes that add or remove kill-bit entries for the SQLServer ActiveX control CLSID.
• Hunt for network or file artifacts matching the public exploit code (Exploit-DB 4379/4398) in proxy and endpoint logs.
• Review endpoint telemetry for unexpected child processes spawned by browsers or management consoles on hosts with SQL Server tools installed.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.