Skip to the content
The Update Bureau
SQL Server 2022 CU15 + GDR SQL Server 2022 CU15 + GDR Security update
Patch Tuesday

KB5046862

KB5046862: Security update for SQL Server 2022, CU branch, November 2024. SQL OS fixes address two remote code execution paths

In short

The update fixes two Important remote code execution vulnerabilities in SQL Server 2022, including one involving DLL planting and one involving a SQL Server assembly.

Does it affect you? Applies to: SQL Server 2022 systems on Windows. The update package is for x64; installing this security update is optional on computers that do not host SQL Server Reporting Services.

Build
16.0.4155.4
Servicing branch
CU
Security
2 fixed
Restart
Required

For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?

What changes

Fixes 2 changes

SQL OS

2 items
  • Remote code execution might be performed on a SQL Server instance through DLL planting.1
    Fixes bug 3561051 in the SQL Server Engine on Windows.
  • A vulnerability in a SQL Server assembly might allow remote code execution.2
    Fixes bug 3561055 in the SQL Server Engine on Windows.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-11-12
Classification
Security Updates
Type
Cumulative update
Servicing branch
CU
Restart
Required
Replaces
KB5046059, KB5041321, KB5042578, KB5038325
+6 earlier KB5040939, KB5036432, KB5036343, KB5033663, KB5032679, KB5033592
Replaced by
KB5058721
VersionBuildChannel
2022 16.0.4155.4 General availability

Security

2 vulnerabilities fixed
2 important
VulnerabilitySeverityCVSS
CVE-2024-49021
Microsoft SQL Server Remote Code Execution Vulnerability
 Important 7.8
CVE-2024-49043
Microsoft.SqlServer.XEvent.Configuration.dll Remote Code Execution Vulnerability
 Important 7.8

Downloads (Microsoft Update Catalog)

Package 2022
455.2 MB
sqlserver2022-kb5046862-x64.exe Main update · KB5046862 SHA-1: 35410381…8d46c0

Sources

Updated
Cited passages from Microsoft's official notes (2)
  1. 1. Fixes an issue in which remote code executions might be performed by using a dynamic-link library (DLL) planting technique on a SQL Server instance. support.microsoft.com
  2. 2. Fixes an issue in which a vulnerability in a SQL Server assembly might allow remote code execution. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 2 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake