Vulnerability in Microsoft Data Access Components

CVE-2011-0026

Integer signedness error in the SQLConnectW function in an ODBC API (odbc32.dll) in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2, and Windows Data Access Components (WDAC) 6.0, allows remote attackers to execute arbitrary code via a long string in the Data Source Name (DSN) and a crafted szDSN argument, which bypasses a signed comparison and leads to a buffer overflow, aka "DSN Overflow Vulnerability."

Published 2011-01-12 · last modified 2026-06-16.

CVSS v2 metric

CVSS v2 base score 9.3 (High). Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.344 (98.4th percentile), scored 2026-09-28.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 98.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.344 · newest: 0.344 · change: 0.000

Affected products

Microsoft Data Access Components — versions 2.8
Microsoft Windows 2003 Server
Microsoft Windows 7
Microsoft Windows Data Access Components — versions 6.0
Microsoft Windows Server 2003
Microsoft Windows Server 2008 — versions r2
Microsoft Windows Vista
Microsoft Windows Xp

Weakness classification (CWE)

CWE-189

References

www.vupen.com/english/advisories/2011/0075 (vdb-entry)
www.securityfocus.com/bid/45695 (vdb-entry)
docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-002 (vendor-advisory)
osvdb.org/70443 (vdb-entry)
www.securitytracker.com/id (vdb-entry)
oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:12333 (signature, vdb-entry)
www.zerodayinitiative.com/advisories/ZDI-11-001/
secunia.com/advisories/42804 (third-party-advisory)
www.us-cert.gov/cas/techalerts/TA11-011A.html (US Government Resource, third-party-advisory)
support.avaya.com/css/P8/documents/100124846