The Update BureauKB5042578: Security update for SQL Server 2022, CU branch, September 2024. CDC capture jobs can fail; temporal-table quoting fixed
Addresses 12 vulnerabilities and fixes temporal-table name quoting. In databases with CDC enabled, some column names might be missing from tracking tables, which can cause capture jobs to fail.
Does it affect you? Applies to: Systems running SQL Server 2022. The update package is for x64; the known issue affects databases with change data capture (CDC) enabled.
Review notes Additional details from the official release notes (1) Read note
- Known issues CDC upgrades or restores can also be affected by tracking-table column names containing symbols such as &, <, or >, or certain control characters—not only commas.
The official sources are linked at the end of the page.
For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?
What changes
Improvements 2 changes
Query Execution
-
Running PREDICT with an incorrect model gets validation to help avoid errors.1
Adds validation for the
MODELparameter when runningPREDICT.
Replication
-
CDC gains a capability to lock down metadata definitions and block DDL operations.2
Adds metadata definition lockdown capability to change data capture (CDC).
Fix 1 change
Temporal
-
Stored procedures that manage temporal tables quote table and column names correctly when building internal SQL batches.3
Fixes cases where names read from database metadata were not correctly quoted.
Known issues
-
CDC capture job might fail if columns are missing in CDC change tables
In databases with CDC enabled, columns with commas might be missing from CDC tracking tables and cause capture jobs to fail. If a database is restored with KEEP_CDC, the restore can report an error near the end even though the database restores successfully.4
How to apply the workaround SQL Trace FlagAdd trace flag T15006 and restart the SQL Server service before upgrading. If the GDR is already applied, use the flag and restart before repeating an affected restore, or—if the upgrade dropped columns—disable and reenable CDC on the affected table; this loses change data.4
Step-by-step workaround instructionsShow steps Hide steps5 stepsStep-by-step procedure- Open SQL Server Configuration Manager.
- Select the SQL Server instance, open Properties, and go to Startup Parameters.
- Add
T15006, select Add, then Apply, and restart the SQL Server service before upgrading. - If the GDR is already applied and a database restore was affected, add the trace flag and restart as above, then restore the database again.
- If the GDR upgrade dropped columns, add the trace flag and restart as above, then disable and reenable CDC on the affected table; this causes change data to be lost.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2024-09-10
- Classification
- Security Updates
- Type
- Cumulative update
- Servicing branch
- CU
- Restart
- Required
- Replaces
- KB5038325, KB5040939, KB5036432, KB5036343
- Replaced by
- KB5046059
| Version | Build | Channel |
|---|---|---|
| 2022 | 16.0.4140.3 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft SQL Server Elevation of Privilege Vulnerability
|
Important | 8.8 |
|
Microsoft SQL Server Elevation of Privilege Vulnerability
|
Important | 8.8 |
|
Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
|
Important | 7.1 |
|
Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
|
Important | 7.1 |
|
Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
|
Important | 7.1 |
|
Microsoft SQL Server Elevation of Privilege Vulnerability
|
Not rated | — |
Downloads (Microsoft Update Catalog)
Sources
Cited passages from Microsoft's official notes (4)
-
1.
Adds a validation for the MODEL parameter when running PREDICT to avoid errors that occur because of the input of wrong models.
support.microsoft.com -
2.
Improves security for the change data capture (CDC) feature by adding metadata definition lockdown capability to block data definition language (DDL) operations.
support.microsoft.com -
3.
After the fix is applied, quoting is completed correctly.
support.microsoft.com -
4.
If your CDC-enabled tables have columns whose names contain commas, these columns might be missing from your CDC tracking tables (cdc.<capture_instance>_CT). This condition might cause the capture job to fail.
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 4/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake