Skip to the content
The Update Bureau
SQL Server 2022 CU10 + GDR SQL Server 2022 CU10 + GDR Security update
Patch Tuesday

KB5033592

KB5033592: Security update for SQL Server 2022, CU branch, January 2024. SQL data provider security bypass vulnerability resolved

In short

Resolves a security feature-bypass vulnerability in the SQL data providers. It also updates SQL Server 2022 to build 16.0.4100.1.

Does it affect you? Applies to: SQL Server 2022 installations that have SQL Server 2022 or a CU release through CU10 GDR installed. The listed package is for x64.

Build
16.0.4100.1
Servicing branch
CU
Security
1 fixed
Restart
Required

For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?

What changes

Fix 1 change

SQL data providers

For: SQL Server deployments

  • A security feature-bypass vulnerability in the SQL data providers is resolved.1
    The update addresses CVE-2024-0056 in Microsoft.Data.SqlClient and System.Data.SqlClient. SQL Server is updated to build 16.0.4100.1.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-01-09
Classification
Security Updates
Type
Cumulative update
Servicing branch
CU
Restart
Required
Replaced by
KB5036343
VersionBuildChannel
2022 16.0.4100.1 General availability

Security

1 vulnerability fixed
1 important
VulnerabilitySeverityCVSS
CVE-2024-0056
Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability
 Important 8.7

Downloads (Microsoft Update Catalog)

Package 2022
400.4 MB
sqlserver2022-kb5033592-x64.exe Main update · KB5033592 SHA-1: 6464a9a1…08ac6f

Sources

Updated
Cited passages from Microsoft's official notes (1)
  1. 1. This security update resolves a vulnerability. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 1 quoted passage · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake