Vulnerable libcurl.dll detected in Microsoft Integration Runtime 5.0 bundled ODBC drivers - supported remediation?

Pawan Bhagat 20 Reputation points
2026-08-18T05:13:51.93+00:00

Hello,

Our security vulnerability scanner has identified vulnerable versions of libcurl.dll within the Microsoft Integration Runtime 5.0 installation directory:

C:\Program Files\Microsoft Integration Runtime\5.0\Shared\ODBC Drivers\

We verified that the Self-hosted Integration Runtime is running the latest available Microsoft-supported version.

During our review, we found that some bundled ODBC drivers have newer versions available from the respective vendors, while other drivers do not currently have newer releases available.

We would like guidance on the following:

  1. Are customers permitted to independently upgrade or replace the ODBC drivers bundled with Microsoft Integration Runtime?
  2. Does Microsoft support upgrading individual ODBC drivers within the Integration Runtime installation directory?
  3. If manual upgrades are not supported, what is the recommended remediation for vulnerabilities identified in bundled components such as libcurl.dll?
  4. Is Microsoft planning to update the affected bundled ODBC drivers in a future Integration Runtime release?
  5. Can Microsoft provide an official statement that can be shared with security and audit teams when no vendor-supported fix is currently available?
  6. Can we good to remove older version of some ODBC driver if there is already newer version available ?

Below are some ODBC drivers which have not newer version available
C:\Program Files\Microsoft Integration Runtime\5.0\Shared\ODBC Drivers\Microsoft Google BigQuery ODBC Driver
C:\Program Files\Microsoft Integration Runtime\5.0\Shared\ODBC Drivers\Microsoft Salesforce ODBC Driver
C:\Program Files\Microsoft Integration Runtime\5.0\Shared\ODBC Drivers\Microsoft ServiceNow ODBC Driver
C:\Program Files\Microsoft Integration Runtime\5.0\Gateway\sxs\OracleV2Unbundle\1.0.0.0\libcurl.dll

Any guidance regarding supportability and remediation recommendations would be appreciated.

Thank you.

Azure Data Factory
Azure Data Factory

An Azure service for ingesting, preparing, and transforming data at scale.

Answer accepted by question author
Himaja Y 275 Reputation points Microsoft External Staff Moderator
2026-08-18T13:46:42.31+00:00

Hi Pawan Bhagat,

Thank you for providing the details.

For the Self-hosted Integration Runtime, we recommend not manually upgrading, replacing, or deleting individual ODBC drivers or DLLs (including libcurl.dll) from the Integration Runtime installation directory. These components are part of the Integration Runtime package, and manual changes may cause compatibility issues or put the installation into an unsupported state.

Even if a newer version of an ODBC driver is available from the vendor, please do not manually remove or replace the bundled version. The recommended approach is to keep the Self-hosted Integration Runtime on the latest Microsoft-supported version and monitor for a future supported update that addresses the vulnerable component.

If no supported fix is currently available, you can document the security finding with your security/audit team and continue monitoring for updates. We also recommend contacting Microsoft Support if you require an official statement regarding the specific vulnerability or its remediation status.

For the listed BigQuery, Salesforce, ServiceNow, and Oracle components, the same guidance applies. Please avoid manually modifying or deleting the bundled drivers or DLLs.

Was this answer helpful?

1 person found this answer helpful.
0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vinodh247-1375 44,316 Reputation points Volunteer Moderator
    2026-08-19T16:37:16.8+00:00

    Hi ,

    Thanks for reaching out to Microsoft Q&A.

    The key consideration is supportability. Components installed under the SHIR directory are generally delivered, tested, and validated as part of the SHIR release. Because of that, manually modifying bundled components should be approached with caution.

    For the questions raised:

    1. Can customers independently upgrade or replace bundled ODBC drivers? While it may be technically possible, it is generally not recommended unless Microsoft has explicitly documented that the driver can be upgraded independently of the SHIR release.
    2. Does Microsoft support upgrading individual ODBC drivers within the IR installation directory? There does not appear to be publicly documented guidance indicating that individual SHIR-bundled drivers are intended to be upgraded separately from the Integration Runtime release itself.

    What is the recommended remediation for vulnerable components such as libcurl.dll? The typical approach is to keep SHIR updated to the latest supported version and obtain dependency updates through subsequent SHIR releases. Replacing libcurl.dll directly may introduce version mismatches with the components that were validated against the shipped version.

    Will Microsoft update the affected drivers in a future release? That depends on the product team's release plans. In general, bundled dependencies are updated through future SHIR releases rather than through customer-managed patching of individual files.

    What can be provided to security and audit teams if no newer vendor version is available? A reasonable position is that the organization is running the latest supported SHIR version and that the identified library is a Microsoft-distributed dependency. Vulnerability findings should be assessed based on actual exposure and exploitability within the SHIR execution context, not solely on file version detection.

    Can older ODBC driver versions be removed when newer versions are also present? I would not recommend removing them. Even when multiple versions exist, SHIR or specific connectors may rely on a particular version or path. Removing files could lead to unexpected connector failures.

    For the components you listed:

    • Microsoft Google BigQuery ODBC Driver
    • Microsoft Salesforce ODBC Driver
    • Microsoft ServiceNow ODBC Driver
    • Gateway\sxs\OracleV2Unbundle\1.0.0.0\libcurl.dll

    I would treat them as Microsoft-distributed dependencies of SHIR. Unless Microsoft has published guidance stating otherwise, replacing, deleting, or upgrading those components independently carries some risk because they are part of the validated Integration Runtime installation.

    One additional point: a vulnerability scanner identifying a vulnerable libcurl.dll version does not automatically mean the vulnerability is exploitable in SHIR. The practical risk depends on how that library is used, whether the vulnerable code path is reachable, and whether compensating controls already exist in the environment.

    In short: keep SHIR updated, avoid manually replacing or deleting bundled drivers and DLLs, and evaluate findings based on exploitability and operational risk rather than file version alone.

    Please 'Upvote'(Thumbs-up) and 'Accept' as answer if the reply was helpful. This will be benefitting other community members who face the same issue.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.