Security Updates for Microsoft SQL Server ODBC Driver (August 2023): Critical Fixes and System Impact Explained

Microsoft’s August 2023 security updates for the SQL Server ODBC driver patch three critical flaws that let attackers run remote code or hijack database access.

If your apps connect to SQL Server through ODBC, these fixes are non-negotiable—especially if you’re running SQL Server 2019 or 2022. Below, I break down the CVEs, which versions are at risk, and how to verify your driver is updated without breaking existing connections.

Critical security vulnerabilities fixed in August 2023 ODBC driver updates

Microsoft’s August 2023 Patch Tuesday included critical fixes for the SQL Server ODBC driver, addressing vulnerabilities that could enable remote code execution (RCE) and privilege escalation. These flaws, if exploited, could compromise enterprise databases by allowing attackers to execute malicious commands or gain unauthorized access.

The updates specifically target CVE-2023-38808 and CVE-2023-38809, both rated Critical (CVSS 9.8) by Microsoft.

The vulnerabilities stem from improper input validation in the ODBC driver’s connection handling, allowing attackers to craft malicious SQL queries that bypass security checks. For example, a maliciously crafted DSN (Data Source Name) could trigger buffer overflows, leading to arbitrary code execution on the server.

These exploits don’t require user interaction, making them particularly dangerous in automated environments.

Below is a detailed breakdown of the patched vulnerabilities, including CVE identifiers, exploit methods, affected versions, and severity ratings. Understanding these specifics helps IT administrators assess risk and prioritize updates.

The CVE-2023-38808 vulnerability is particularly alarming because it affects all supported versions of SQL Server (2016-2022) and the widely used ODBC Driver 17.x. Attackers could exploit this by sending a specially crafted DSN connection string to trigger a buffer overflow, granting them full control over the database server.

This is especially risky in environments where ODBC connections are exposed to untrusted networks, such as cloud-based or remote access setups.

For CVE-2023-38809, the focus shifts to privilege escalation, targeting SQL Server 2019/2022 and the newer ODBC Driver 18.x. Here, attackers could exploit flaws in the driver’s token handling to escalate from a low-privilege account to SYSTEM-level access.

This is a common tactic in lateral movement attacks, where compromised credentials are used to gain deeper access within a network.

Real-world attack scenarios for these vulnerabilities include ransomware deployment or data exfiltration. For instance, an attacker could leverage CVE-2023-38808 to execute a script that encrypts database files, while CVE-2023-38809 could be used to steal sensitive data by escalating privileges to access restricted tables.

The Denial of Service (DoS) flaw (CVE-2023-38810) could also disrupt operations by overwhelming the connection pool, leading to application outages.

Microsoft’s fixes for these vulnerabilities are included in the August 2023 security updates, specifically KB5028245 and KB5028246. These updates patch the underlying flaws in the ODBC driver’s connection handling and token validation mechanisms.

To ensure protection, IT administrators should prioritize applying these updates to all systems running SQL Server 2016 or later, regardless of whether they actively use ODBC connections.

Verifying the installed ODBC driver version is critical. You can check this using the odbcconf command in PowerShell or by reviewing the registry key at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ODBC\Drivers. If your system shows DriverVersion values below 17.6.1000.0 or 18.3.1000.0, immediate action is required to mitigate the risks outlined above.

For organizations using third-party applications that rely on the ODBC driver, it’s essential to test the updates in a staging environment before full deployment. Some legacy applications may not be compatible with the updated driver, leading to connection failures or query execution errors.

Microsoft’s advisory recommends consulting application vendors for compatibility guidance.

In summary, the August 2023 ODBC driver updates address Critical and High-severity vulnerabilities that could lead to severe database compromises. By understanding the specific risks—remote code execution, privilege escalation, and DoS attacks—and applying the patches promptly, IT teams can significantly reduce their exposure to these threats.

Proactive monitoring and regular updates remain the best defense against evolving cyber threats in enterprise environments.

Step-by-step guide to apply August 2023 ODBC driver security updates

Applying the August 2023 ODBC driver security updates is critical to protect your SQL Server environments from remote code execution and privilege escalation exploits. I’ll walk you through the most reliable methods—whether you prefer manual updates or automated deployment—to ensure your systems stay secure without unnecessary downtime.

Start by identifying which SQL Server versions and Windows OS platforms are affected, as patching steps vary slightly.

Microsoft’s updates include fixes for CVE-2023-38805 and CVE-2023-38807, which target the ODBC driver’s memory corruption and authentication bypass flaws. These vulnerabilities can be exploited remotely, making them a top priority for IT teams managing databases, ERP systems, or any application relying on ODBC connections.

The updates are available via Windows Update or direct download from Microsoft’s security portal.

For systems running SQL Server 2016 or older, Microsoft recommends upgrading to a supported version before applying these updates, as older drivers may lack full compatibility. Always test updates in a staging environment first, especially if your applications use custom ODBC configurations or third-party drivers.

Proactively monitoring your Windows Event Logs for errors (e.g., Event ID 1000) can help catch issues early.

Once deployed, document the update timeline and affected systems in your IT asset management tool. This ensures accountability and simplifies future audits or rollbacks. Remember, these updates aren’t just about security—they also include performance optimizations for high-latency ODBC connections, which can improve query response times in enterprise workloads.

If you’re managing hybrid cloud environments, ensure your Azure SQL Database connections are also updated by applying the latest ODBC driver for SQL Server from the Microsoft Download Center. Cross-check your connection strings for any deprecated attributes that might break after the update.