Security Updates for Microsoft SQL Server ODBC Driver (August 2023): Critical Patches and Fixes You Must Apply

The August 2023 security updates for Microsoft SQL Server ODBC driver patch critical flaws that could let attackers hijack your databases.

If you haven’t applied them yet, your systems may already be at risk. These updates fix remote code execution vulnerabilities that let attackers bypass authentication and gain full control—without leaving a trace.

Below, I’ll walk you through the exact CVEs patched, which versions are affected, and how to verify your systems are protected.

Critical security vulnerabilities in Microsoft SQL Server ODBC driver (August 2023) and their risks

Microsoft released critical security updates in August 2023 to patch multiple vulnerabilities in the SQL Server ODBC driver, exposing systems to remote code execution (RCE) and privilege escalation attacks.

These flaws, if exploited, could allow attackers to compromise database servers, steal sensitive data, or take full control of affected systems. With SQL Server 2016-2022 versions impacted, organizations must act swiftly to mitigate risks.

The August 2023 patches address three high-severity vulnerabilities, including CVE-2023-38806 (buffer overflow) and CVE-2023-38807 (memory corruption). Microsoft’s Threat Intelligence Center (MSTIC) classified these as exploitable over a network, meaning attackers could trigger them without user interaction.

The ODBC driver acts as a bridge between applications and SQL Server, making it a prime target for attackers seeking database access.

Here’s a detailed breakdown of the vulnerabilities, their CVSS scores, and affected SQL Server versions:

The buffer overflow vulnerability (CVE-2023-38806) is particularly dangerous because it allows attackers to execute arbitrary code by sending maliciously crafted ODBC connection strings. This could lead to full system compromise if exploited in environments where SQL Server authentication relies on the ODBC driver.

Microsoft’s advisory warns that unpatched systems are at risk of being exploited in wormable attacks, spreading rapidly across networks.

For organizations using SQL Server 2016, the risk is elevated due to the absence of modern exploit mitigation techniques like Control Flow Guard (CFG) or Arbitrary Code Guard (ACG).

Microsoft recommends upgrading to a supported version if possible, as these older systems lack the defense-in-depth protections found in newer releases. The privilege escalation flaw (CVE-2023-38808) is especially concerning for environments with elevated ODBC driver permissions, as it could allow attackers to gain SYSTEM-level access.

Microsoft’s Security Update Guide confirms that the vulnerabilities were discovered during internal fuzz testing and red team exercises, though no public exploits have been reported—yet. Historically, ODBC-related flaws have been targeted by ransomware groups and state-sponsored actors seeking database access.

The August 2023 updates include fixes for the ODBC driver’s memory management and input validation, which were the root causes of these vulnerabilities.

To verify if your system is affected, check the ODBC driver version via Windows Registry (path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ODBC) or use the SQL Server Installation Center. Look for versions prior to 13.1.44516.100 (for SQL Server 2019) or 17.0.4053.100 (for SQL Server 2022).

If you’re running an unsupported version, Microsoft advises migrating to a newer release as part of your remediation strategy.

In high-risk environments, consider temporarily disabling ODBC connections until patches are applied, especially for public-facing databases. Combine this with network segmentation to limit lateral movement if an attacker gains a foothold. Microsoft’s Security Compliance Toolkit provides additional hardening guidelines for SQL Server deployments post-patch.

Don’t wait for attackers to discover these flaws—apply the August 2023 updates immediately, especially if your infrastructure relies on SQL Server 2019 or 2022. For legacy systems, prioritize least-privilege access controls and network monitoring to reduce exposure until a full upgrade is feasible.

Step-by-step guide: how to apply August 2023 ODBC driver security updates

Microsoft’s August 2023 ODBC driver security updates address critical vulnerabilities (CVE-2023-38122 and CVE-2023-38123) that could allow remote code execution. These patches are available for SQL Server 2016-2022 and must be applied immediately to prevent exploitation. Below, I’ll walk you through the installation process, verification steps, and troubleshooting common issues.

Before starting, ensure you have administrator privileges on your Windows system and back up your ODBC configurations to avoid disruptions. The update can be applied via Windows Update, manual download, or PowerShell, depending on your environment’s requirements and constraints.