Skip to the content
The Update Bureau
SQL Server 2022 GDR SQL Server 2022 GDR Security update
Patch Tuesday

KB5042211

KB5042211: Security update for SQL Server 2022, GDR branch, September 2024. CDC upgrades risk missing columns; 12 vulnerabilities addressed

In short

Addresses 12 vulnerabilities. Applying it can also expose a CDC issue that causes missing tracking-table columns and failed capture jobs, upgrades, or restores.

Does it affect you? Applies to: Servers running SQL Server 2022 GDR, x64. The update is optional for computers that do not host Microsoft SQL Server Reporting Services.

Build
16.0.1125.1
Servicing branch
GDR
Security
12 fixed
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • Known issues This issue affects SQL Server databases with change data capture (CDC) enabled. It is relevant to people administering those databases.

The official sources are linked at the end of the page.

For servers on the GDR branch: they get security fixes only. Servers that install cumulative updates (CU branch) get a separate update. Which branch am I on?

What changes

Improvements 2 changes

Query Execution

  • PREDICT checks the MODEL parameter to help avoid errors caused by an incorrect model.1
    Adds validation for the MODEL parameter when running PREDICT.

Replication

  • CDC can block changes to database definitions, improving security for the feature.2
    Adds metadata definition lockdown capability to block data definition language (DDL) operations.

Fix 1 change

Temporal

  • Stored procedures that manage temporal tables correctly quote table and column names read from database metadata.3
    Fixes cases where names read from database metadata aren't correctly quoted when internal SQL Server batches are built.

Known issues

  1. Open Affects: Everyone

    CDC capture job might fail if columns are missing in CDC change tables

    In CDC-enabled databases, columns whose names contain commas might be missing from CDC tracking tables. The CDC upgrade or restore process might also fail when tracking-table column names contain symbols such as &, <, > or characters with ASCII decimal codes below 32, except tab and line feed. Capture jobs or applications that use the affected tables might fail; restoring with KEEP_CDC can also trigger the issue.4

    How to apply the workaround SQL Trace Flag

    Use trace flag T15006 before an upgrade. If the GDR is already applied and comma-containing columns were dropped, add the flag and restart; rerun an affected restore, or disable and re-enable CDC on the affected table. Disabling and re-enabling CDC loses change data.4

    Step-by-step workaround instructions
    5 steps
    Show steps Hide steps
    Step-by-step procedure
    1. In SQL Server Configuration Manager, open the SQL Server instance's Properties and go to Startup Parameters.
    2. Add trace flag T15006, select Add and Apply, then restart the SQL Server service.
    3. If the flag was added before an upgrade, perform the upgrade while it is active.
    4. If the GDR is already applied and comma-containing columns were dropped, add the flag and restart. If a restore was affected, restore the database again.
    5. If the GDR upgrade dropped columns, disable and re-enable CDC on the affected table using sp_cdc_disable_table and sp_cdc_enable_table; this causes change data to be lost.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-09-10
Classification
Security Updates
Type
Cumulative update
Servicing branch
GDR
Restart
Required
Replaces
KB5040936, KB5035432, KB5032968
Replaced by
KB5046057
VersionBuildChannel
2022 16.0.1125.1 General availability

Security

12 vulnerabilities fixed
11 important 1 not rated
VulnerabilitySeverityCVSS
CVE-2024-26186
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-26191
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-37335
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-37338
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-37339
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-37340
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-37965
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2024-37980
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2024-37337
Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
 Important 7.1
CVE-2024-37342
Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
 Important 7.1
CVE-2024-37966
Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
 Important 7.1
CVE-2024-37341
Microsoft SQL Server Elevation of Privilege Vulnerability
 Not rated —

Downloads (Microsoft Update Catalog)

Package 2022
325.6 MB
sqlserver2022-kb5042211-x64.exe Main update · KB5042211 SHA-1: f73df5c3…52e5f7

Sources

Updated
Cited passages from Microsoft's official notes (4)
  1. 1. Adds a validation for the MODEL parameter when running PREDICT to avoid errors that occur because of the input of wrong models. support.microsoft.com
  2. 2. Improves security for the change data capture (CDC) feature by adding metadata definition lockdown capability to block data definition language (DDL) operations. support.microsoft.com
  3. 3. Fixes an issue in which table and column names that are read from database metadata aren't correctly quoted in some cases when building internal SQL Server batches in stored procedures that manage temporal tables. support.microsoft.com
  4. 4. This action might fail if a CDC tracking table (cdc.<capture_instance>_CT) has columns whose name contains any symbol, such as &, <, >, or characters whose ASCII decimal code is less than 32 support.microsoft.com
Checked automatically: 7 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake