← Vulnerability feed

Vulnerability record · CVE-2011-0026 · published 12 January 2011

CVE-2011-0026: Microsoft data access components vulnerability

Microsoft · Data Access Components

Integer signedness error in the SQLConnectW function in an ODBC API (odbc32.dll) in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2, and Windows Data Access Components (WDAC) 6.0, allows remote attackers to execute arbitrary code via a long string in the Data Source Name (DSN) and a crafted szDSN argument, which bypasses a signed comparison and leads to a buffer overflow, aka "DSN Overflow Vulnerability."

9.3 CVSS 2.0 High EPSS 34% · top 1.6% CWE-189 · CWE-189
9.3CVSS 2.0 base score
34%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
20References
16 Jun 2026Last modified by NVD

Description

Integer signedness error in the SQLConnectW function in an ODBC API (odbc32.dll) in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2, and Windows Data Access Components (WDAC) 6.0, allows remote attackers to execute arbitrary code via a long string in the Data Source Name (DSN) and a crafted szDSN argument, which bypasses a signed comparison and leads to a buffer overflow, aka "DSN Overflow Vulnerability."

AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://osvdb.org/70443
http://secunia.com/advisories/42804
http://support.avaya.com/css/P8/documents/100124846
http://www.securityfocus.com/bid/45695
http://www.securitytracker.com/id?1024947
http://www.us-cert.gov/cas/techalerts/TA11-011A.html US Government Resource
http://www.vupen.com/english/advisories/2011/0075
http://www.zerodayinitiative.com/advisories/ZDI-11-001/
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-002
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12333
http://osvdb.org/70443
http://secunia.com/advisories/42804
http://support.avaya.com/css/P8/documents/100124846
http://www.securityfocus.com/bid/45695
http://www.securitytracker.com/id?1024947
http://www.us-cert.gov/cas/techalerts/TA11-011A.html US Government Resource
http://www.vupen.com/english/advisories/2011/0075
http://www.zerodayinitiative.com/advisories/ZDI-11-001/
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-002
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12333

Track CVE-2011-0026 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2003-0903Microsoft data access components memory buffer overflow vulnerabilityBuffer overflow in a component of Microsoft Data Access Components (MDAC) 2.5 through 2.8 allows remote attackers to execute arbitrary code via a mal…EPSS 37%10.0CVE-2002-1918Microsoft data access components vulnerabilityBuffer overflow in Microsoft Active Data Objects (ADO) in Microsoft MDAC 2.5 through 2.7 allows remote attackers to have unknown impact with unknown …EPSS 16%10.0CVE-1999-1011Microsoft MDAC RDS DataFactory unsafe methods allow remote command executionThe Remote Data Service (RDS) DataFactory component of Microsoft Data Access Components (MDAC), as shipped with IIS 3.x and 4.x, exposes unsafe metho…EPSS 77%analysed9.8CVE-2012-1891Microsoft data access components memory buffer overflow vulnerabilityHeap-based buffer overflow in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2 and Windows Data Access Components (WDAC) 6.0 allows remote att…EPSS 29%9.3CVE-2011-0027Microsoft MDAC/WDAC ADO Record memory allocation flaw enables remote code executionMicrosoft Data Access Components (MDAC) 2.8 SP1/SP2 and Windows Data Access Components (WDAC) 6.0 fail to properly validate memory allocation for int…EPSS 54%analysed9.3CVE-2006-5559Microsoft data access components improper input validation vulnerabilityThe Execute method in the ADODB.Connection 2.7 and 2.8 ActiveX control objects (ADODB.Connection.2.7 and ADODB.Connection.2.8) in the Microsoft Data …EPSS 44%7.5CVE-2003-0353Microsoft data access components vulnerabilityBuffer overflow in a component of SQL-DMO for Microsoft Data Access Components (MDAC) 2.5 through 2.7 allows remote attackers to execute arbitrary co…EPSS 22%7.5CVE-2002-1142Microsoft MDAC RDS Data Stub heap buffer overflow allows remote code executionA heap-based buffer overflow exists in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) 2.1 through 2.6 and Intern…EPSS 76%analysed

Source: NIST National Vulnerability Database (record CVE-2011-0026), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.