CVE-2002-1137: Microsoft Data Engine

High severity, CVSS 7.5. EPSS: 9.4% chance of exploitation in the next 30 days.

Buffer overflow in the Database Console Command (DBCC) that handles user inputs in Microsoft SQL Server 7.0 and 2000, including Microsoft Data Engine (MSDE) 1.0 and Microsoft Desktop Engine (MSDE) 2000, allows attackers to execute arbitrary code via a long SourceDB argument in a "non-SQL OLEDB data source" such as FoxPro, a variant of CAN-2002-0644.

Affected products

• Microsoft Data Engine: version 1.0 only; version 2000 only
• Microsoft SQL Server: version 7.0 only; version 2000 only

Published 2002-10-11. Last modified 2026-06-16.