CVE-2008-0086: Microsoft Data Engine

High severity, CVSS 9.0. EPSS: 61.9% chance of exploitation in the next 30 days.

Buffer overflow in the convert function in Microsoft SQL Server 2000 SP4, 2000 Desktop Engine (MSDE 2000) SP4, and 2000 Desktop Engine (WMSDE) allows remote authenticated users to execute arbitrary code via a crafted SQL expression.

Affected products

• Microsoft Data Engine: version 1.0 only
• Microsoft SQL Server: version 7.0 only; version 2000 only; version 2005 only
• Microsoft SQL Server Desktop Engine: version 2000 only
• Microsoft SQL Server Express Edition: version 2005 only

Published 2008-07-08. Last modified 2026-06-16.