CVE-2008-0106: Microsoft Data Engine

High severity, CVSS 9.0. EPSS: 35.3% chance of exploitation in the next 30 days.

Buffer overflow in Microsoft SQL Server 2005 SP1 and SP2, and 2005 Express Edition SP1 and SP2, allows remote authenticated users to execute arbitrary code via a crafted insert statement.

Affected products

• Microsoft Data Engine: version 1.0 only
• Microsoft SQL Server: version 7.0 only; version 2000 only; version 2005 only
• Microsoft SQL Server Desktop Engine: version 2000 only
• Microsoft SQL Server Express Edition: version 2005 only

Published 2008-07-08. Last modified 2026-06-16.