Skip to the content
The Update Bureau
SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update
Patch Tuesday

KB5046858

KB5046858: Security update for SQL Server 2017, CU branch, November 2024. Native Client remote-code flaws patched; DLL planting fixed

In short

Addresses 31 Important-severity vulnerabilities, including remote-code execution flaws in SQL Server Native Client. It also fixes two SQL Server Engine issues involving remote code execution.

Does it affect you? Applies to: Devices running SQL Server 2017, including the base release or any CU release through CU31 GDR. The listed fixes apply to Windows; the standalone package is x64. Installing the security update is optional on computers that do not host SQL Server Reporting Services.

Build
14.0.3485.1
Servicing branch
CU
Security
31 fixed
Restart
Required

For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?

What changes

Fixes 2 changes

SQL OS

2 items
  • Remote code execution through DLL planting on a SQL Server instance is fixed.1
    Bug reference 3542148; platform: Windows.
  • A vulnerability in a SQL Server assembly that might allow remote code execution is fixed.2
    Bug reference 3540556; platform: Windows.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-11-12
Classification
Security Updates
Type
Cumulative update
Servicing branch
CU
Restart
Required
Replaces
KB5046061, KB5042215, KB5040940
Replaced by
KB5058714
VersionBuildChannel
2017 14.0.3485.1 General availability

Security

31 vulnerabilities fixed
31 important
VulnerabilitySeverityCVSS

The table lists the 0 exploited, publicly disclosed or critical vulnerabilities. See all 31 vulnerabilities →

Downloads (Microsoft Update Catalog)

Package 2017
542.5 MB
sqlserver2017-kb5046858-x64.exe Main update · KB5046858 SHA-1: b681ef61…e89928

Sources

Updated
Cited passages from Microsoft's official notes (2)
  1. 1. Fixes an issue in which remote code executions might be performed by using a dynamic-link library (DLL) planting technique on a SQL Server instance. support.microsoft.com
  2. 2. Fixes an issue in which a vulnerability in a SQL Server assembly might allow remote code execution. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 2 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake