Code execution via undisclosed heap buffer overflow

A heap-based buffer overflow in Microsoft SQL Server Native Client allows remote attackers to execute code after required user interaction. Microsoft has not disclosed the specific parser, malformed field, or incorrect memory operation that triggers the overflow. Successful exploitation runs attacker-controlled code in the affected client's security context, and no authentication to the malicious endpoint is required.