KB5042214: Security update for SQL Server 2019, GDR branch, September 2024. Machine Learning Services flaws addressed; CDC upgrades can fail

Addresses 12 Important vulnerabilities, including flaws in Machine Learning Services. It also adds a CDC upgrade safeguard, but CDC databases with certain column names might encounter missing columns or restore and upgrade errors.

Does it affect you? Applies to: SQL Server 2019 installations on the GDR servicing branch. The update package is x64; installing it is optional on computers that do not host SQL Server Reporting Services.

Review notes Additional details from the official release notes (1) Read note

In short The update adds a CDC capability to block DDL operations, but the issue that can cause missing CDC columns and capture-job, restore, or upgrade errors remains open.

The official sources are linked at the end of the page.

For servers on the GDR branch: they get security fixes only. Servers that install cumulative updates (CU branch) get a separate update. Which branch am I on?

What changes

Improvements 2 changes

Query Execution

PREDICT checks the MODEL parameter before running, helping avoid errors caused by an incorrect model.¹
Adds validation for the MODEL parameter when running PREDICT.

Replication

CDC gains a capability to block data-definition changes that could affect its metadata.²
Adds metadata definition lockdown capability to block data definition language (DDL) operations for change data capture (CDC).

Fix 1 change

Temporal

Stored procedures that manage temporal tables quote table and column names correctly when building internal SQL batches.³
Corrects quoting of table and column names read from database metadata when building internal SQL Server batches.

Known issues

Open Affects: Everyone

CDC capture job might fail if columns are missing in CDC change tables

In CDC databases, columns with commas in their names might be missing from CDC tracking tables, causing capture jobs to fail or applications to report an unknown column. The CDC upgrade procedure might also fail when tracking tables contain columns with symbols such as &, <, or >, or certain control characters. With KEEP_CDC, a restore might report an error near the end even though the database restores successfully; an upgrade can also report an error in the SQL Server log despite the GDR upgrade being reported as successful.⁴

How to apply the workaround SQL Trace Flag

Before upgrading, add trace flag T15006 and restart the SQL Server service. If the GDR is already applied and columns were dropped, add the flag and restart; repeat the restore if that scenario was affected, or disable and reenable CDC on the affected table if the upgrade dropped columns. Disabling and reenabling CDC causes change data to be lost.⁴
Step-by-step workaround instructions
5 steps

Show steps Hide steps
Step-by-step procedure
1. In SQL Server Configuration Manager, open the instance properties and go to the Startup Parameters tab.
2. Add trace flag T15006, select Add, then Apply, and restart the SQL Server service.
3. Perform the upgrade while the trace flag is active.
4. If the GDR is already applied and columns were dropped, repeat the trace-flag setup and restart. Repeat the database restore if the restore scenario was affected.
5. If the upgrade dropped columns, disable and reenable CDC on the affected table, noting that this loses change data.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2024-09-10
Classification: Security Updates
Type: Cumulative update
Servicing branch: GDR
Restart: Required
Replaces: KB5040986, KB5035434
Replaced by: KB5046056

Version	Build	Channel
2019	15.0.2120.1	General availability

Security

12 vulnerabilities fixed

12 important

Vulnerability	Severity	CVSS
CVE-2024-26186 Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability	Important	8.8
CVE-2024-26191 Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability	Important	8.8
CVE-2024-37335 Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability	Important	8.8
CVE-2024-37338 Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability	Important	8.8
CVE-2024-37339 Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability	Important	8.8
CVE-2024-37340 Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability	Important	8.8
CVE-2024-37965 Microsoft SQL Server Elevation of Privilege Vulnerability	Important	8.8
CVE-2024-37980 Microsoft SQL Server Elevation of Privilege Vulnerability	Important	8.8
CVE-2024-43474 Microsoft SQL Server Information Disclosure Vulnerability	Important	7.6
CVE-2024-37337 Microsoft SQL Server Native Scoring Information Disclosure Vulnerability	Important	7.1
CVE-2024-37342 Microsoft SQL Server Native Scoring Information Disclosure Vulnerability	Important	7.1
CVE-2024-37966 Microsoft SQL Server Native Scoring Information Disclosure Vulnerability	Important	7.1

Downloads (Microsoft Update Catalog)

Package 2019

494.7 MB

sqlserver2019-kb5042214-x64.exe Main update · KB5042214 SHA-1: a51d39f0…3df555

Sources

Microsoft Support: KB5042214

Updated Oct 27, 2026

Cited passages from Microsoft's official notes (4)

1. Adds a validation for the MODEL parameter when running PREDICT to avoid errors that occur because of the input of wrong models. support.microsoft.com
2. Improves security for the change data capture (CDC) feature by adding metadata definition lockdown capability to block data definition language (DDL) operations. support.microsoft.com
3. Fixes an issue in which table and column names that are read from database metadata aren't correctly quoted in some cases when building internal SQL Server batches in stored procedures that manage temporal tables. support.microsoft.com
4. This action might fail if a CDC tracking table (cdc.<capture_instance>_CT) has columns whose name contains any symbol, such as &, <, >, or characters whose ASCII decimal code is less than 32 (except 9-Tab and 10-LineFeed). support.microsoft.com

Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 3/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake