Security Updates for Microsoft SQL Server ODBC Driver (October 2023): Patch Details and Compatibility Checklist

The October 2023 security updates for Microsoft SQL Server ODBC driver address critical vulnerabilities that could let attackers hijack database connections or execute malicious code.

If you’re running an older ODBC driver version—especially 13.x or 17.x—your systems might already be exposed. Microsoft’s patches fix flaws like remote code execution and authentication bypasses, but skipping them leaves your data at risk.

Here’s what’s changing in this update, which versions are affected, and how to apply the patch without breaking your applications.

You’ll also learn how to verify the update worked, spot compatibility red flags, and test for side effects before rolling it out to production.

Critical security patches in October 2023 ODBC driver Update: vulnerabilities and fixes

Microsoft’s October 2023 ODBC driver update for SQL Server addresses five critical vulnerabilities, including remote code execution (RCE) and spoofing risks. These flaws could allow attackers to escalate privileges or bypass authentication if left unpatched.

The update targets driver versions 17.x, 13.x, and 11.x, covering both 32-bit and 64-bit architectures.

The most severe issue, CVE-2023-38806, is a memory corruption vulnerability in the ODBC driver’s SQLGetData function. This flaw could let attackers execute arbitrary code with SYSTEM-level privileges if they send a maliciously crafted connection string.

Microsoft rates this as Critical (CVSS 9.8) due to its potential for full system compromise.

Other patched vulnerabilities include:

• CVE-2023-38807: Authentication bypass via spoofed ODBC connection strings.
• CVE-2023-38808: Denial-of-Service (DoS) through crafted SQL queries.
• CVE-2023-38809: Information disclosure via ODBC metadata requests.

Microsoft’s Knowledge Base (KB) articles for these updates are:

• KB5029345 (17.x)
• KB5029346 (13.x/11.x)

The update applies to systems running Windows 10/11, Windows Server 2016/2019/2022, and integrates with Windows Update, Microsoft Update Catalog, and manual MSI installers. SQL Server 2019 and later are automatically updated via Windows Update, while older versions require manual intervention.

For SQL Server 2019 and later, the update is delivered via Windows Update and can be verified using the Windows Update History tool.

Navigate to Settings > Update & Security > Windows Update > Update History and look for entries like "2023-10 Cumulative Update for SQL Server ODBC Driver." For manual installation, download the MSI package from the Microsoft Update Catalog.

I recommend testing the update in a non-production environment first, especially if your applications rely on legacy ODBC configurations. Some third-party tools, like Progress DataDirect or Simba ODBC drivers, may require additional updates to maintain compatibility.

Always back up your ODBC Data Source Administrator (ODBCAD32) configurations before applying patches.

If you’re using PowerShell to manage updates, run this command to check installed ODBC driver versions: Get-ItemProperty HKLM:\Software\Microsoft\ODBC\Drivers\* | Select-Object PSChildName, Version This helps identify if your systems are vulnerable before patching.

For enterprises, prioritize patching systems with public-facing ODBC connections, as these are most exposed to remote exploitation. Microsoft’s Security Update Guide provides detailed deployment recommendations for large-scale environments.

Don’t wait until an attacker exploits these flaws—apply the October 2023 ODBC driver update within 72 hours to minimize risk. Monitor your systems post-update for any connection drops or authentication failures, which may indicate compatibility issues.

Step-by-step guide to apply the ODBC driver security Update without disrupting applications

Applying the October 2023 ODBC driver security update requires careful planning to avoid disrupting active database connections. I recommend starting with a non-production environment to test compatibility before rolling out updates. This guide covers both manual and automated patching methods, ensuring minimal downtime for your applications.

Before you begin, verify your current ODBC driver version using the Windows Registry Editor or Control Panel ODBC Data Source Administrator. For example, navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ODBC\Drivers to confirm if you’re running version 17.x, 13.x, or 11.x. Only these versions are eligible for the October 2023 patch.

⚠️ CRITICAL STEP LIST ⚠️

For automated patching, leverage Windows Server Update Services (WSUS) or Microsoft Endpoint Configuration Manager. Push the update during a maintenance window to minimize impact on users. Always prioritize off-peak hours to reduce connection interruptions.

After patching, legacy applications may require adjustments. For example, if your app uses SQL Server 2016, test with the ODBC 13.1 driver as it may introduce connection string changes. Document any API deprecations in Microsoft’s release notes for your driver version.

Finally, use PowerShell to script a pre- and post-patch verification: Get-ItemProperty HKLM:\SOFTWARE\Microsoft\ODBC\Drivers | Select-Object -ExpandProperty PSObject.Properties Compare the output before and after patching to confirm the driver version and registry keys are updated correctly. 🖥️