Skip to the content
The Update Bureau
SQL Server 2016 SP3 + GDR SQL Server 2016 SP3 + GDR Security update
Patch Tuesday

KB5042207

KB5042207: Security update for SQL Server 2016, GDR branch, September 2024. SQL privilege flaws addressed; CDC upgrades may lose columns

In short

Addresses three SQL Server vulnerabilities and fixes a temporal-table quoting problem. CDC upgrades can still drop columns with commas in their names or fail on other symbols.

Does it affect you? Applies to: Servers running SQL Server 2016 SP3 or a SQL Server 2016 SP3 GDR release.

Build
13.0.6445.1
Servicing branch
GDR
Security
3 fixed
Restart
Required

For servers on the GDR branch: they get security fixes only. Servers that install cumulative updates (CU branch) get a separate update. Which branch am I on?

What changes

Fix 1 change

Temporal

  • Stored procedures that manage temporal tables handle table and column names correctly when building internal database commands.1
    Correctly quotes table and column names read from database metadata when building internal SQL Server batches.

Improvement 1 change

Replication

  • CDC gets a security safeguard that blocks certain database-definition changes.2
    Adds metadata definition lockdown capability to block data definition language (DDL) operations.

Known issues

  1. Open Affects: Organizations and IT administrators

    CDC capture job might fail if columns are missing in CDC change tables

    On databases using change data capture (CDC), columns with commas in their names might be missing from CDC tracking tables and cause capture-job failures; a comma-containing column in a tracking table might be dropped during a CDC upgrade. Separately, CDC upgrades can fail when tracking-table column names contain other symbols.3

    How to apply the workaround SQL Trace Flag

    Before upgrading the GDR build, enable trace flag T15006 and restart the SQL Server service.3

    Step-by-step workaround instructions
    3 steps
    Show steps Hide steps
    Step-by-step procedure
    1. In SQL Server Configuration Manager, open the instance properties and go to the Startup Parameters tab.
    2. Add trace flag T15006, select Add and Apply, then restart the SQL Server service.
    3. Perform the GDR upgrade.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-09-10
Classification
Security Updates
Type
Cumulative update
Servicing branch
GDR
Restart
Required
Replaces
KB5040946
Replaced by
KB5046063
VersionBuildChannel
2016 13.0.6445.1 General availability

Security

3 vulnerabilities fixed
2 important 1 not rated
VulnerabilitySeverityCVSS
CVE-2024-37965
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2024-37980
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2024-37341
Microsoft SQL Server Elevation of Privilege Vulnerability
 Not rated —

Downloads (Microsoft Update Catalog)

Package 2016
474.5 MB
sqlserver2016-kb5042207-x64.exe Main update · KB5042207 SHA-1: f38edb8d…64b510

Sources

Updated
Cited passages from Microsoft's official notes (3)
  1. 1. Fixes an issue in which table and column names that are read from database metadata aren't correctly quoted in some cases when building internal SQL Server batches in stored procedures that manage temporal tables. support.microsoft.com
  2. 2. Improves security for the change data capture (CDC) feature by adding metadata definition lockdown capability to block data definition language (DDL) operations. support.microsoft.com
  3. 3. If a column whose name contains a comma exists in the CDC tracking table (cdc.<capture_instance>_CT), the column might be dropped because of functional errors in the CDC upgrade process. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake