KB5049235: Cumulative update for SQL Server 2019, CU branch, December 2024. Remote code execution fixes; parallel SESSION_CONTEXT issue remains

CU30 includes eight fixes, including fixes for remote code execution, but a known issue can still affect SESSION_CONTEXT in parallel plans. KB5049235 has been superseded by KB5049296.

Does it affect you? Applies to: SQL Server 2019 instances, on Windows or Linux. CU30 updates the components installed on the instance and applies to all supported languages.

For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?

What changes

Fixes 8 changes

Integration Services

Extracting data for Google BigQuery with the Simba ODBC driver no longer has the described data discrepancy issue.¹
Fixes a data discrepancy encountered when extracting data for Google BigQuery by using the Simba ODBC driver.

High Availability and Disaster Recovery

2 items

For: All platforms

Some Always On availability group workloads have fewer waits during data movement.²
Reduces HADR_SYNC_COMMIT waits caused by the delay between log_block_pushed_to_pool and hadr_log_block_capture under certain workloads.
Some availability group databases can move to a resolving state after a Windows Server Failover Clustering quorum loss, helping them recover from a non-synchronized state.³
Allows databases to switch to a resolving state when persisted configuration data can't be read because of WSFC quorum loss.

Linux

For: Linux

A system failure in alternatewritethrough mode no longer causes the described database corruption issue.⁴
Fixes database corruption that can occur if a system failure happens with alternatewritethrough mode.

SQL OS

4 items

Queries using columnstore indexes no longer get stuck because of the described scheduler errors.⁵
Fixes queries with columnstore indexes getting stuck because of non-yielding scheduler errors.
Some index builds no longer encounter the described assertion failures.⁶
Fixes assertion failures that might occur when building an index in simple or bulk-logged recovery models with indirect checkpoints because of missing flushes of intermediate data pages.
The described DLL planting issue that might allow remote code execution on a SQL Server instance is fixed.⁷
Fixes an issue in which remote code executions might be performed by using a dynamic-link library (DLL) planting technique on a SQL Server instance.
A vulnerability in a SQL Server assembly that might allow remote code execution is fixed.⁸
Fixes an issue in which a vulnerability in a SQL Server assembly might allow remote code execution.

Known issues

Open Affects: Everyone

Incorrect behavior of SESSION_CONTEXT in parallel plans

Queries that use SESSION_CONTEXT might return incorrect results or trigger access violation dump files when run in parallel query plans, particularly if the session is reset for reuse.⁹

Workaround status No workaround yet

Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2024-12-12
Classification: Updates
Type: Cumulative update
Servicing branch: CU
Restart: Required
Replaces: KB5046365, KB5039747, KB5037331, KB5035123, KB5033688
Replaced by: KB5049296

Version	Build	Channel
2019	15.0.4415.2	General availability

Security

No vulnerabilities are listed for this update.

Downloads (Microsoft Update Catalog)

Package 2019

887.5 MB

sqlserver2019-kb5049235-x64.exe Main update · KB5049235 SHA-1: a17df28b…8ec802

Sources

Microsoft Support: KB5049235

Updated Oct 27, 2026

Cited passages from Microsoft's official notes (9)

1. Fixes a data discrepancy issue that you encounter when extracting data for Google BigQuery by using the Simba ODBC driver. support.microsoft.com
2. Reduces the HADR_SYNC_COMMIT waits caused by the delay between the log_block_pushed_to_pool and hadr_log_block_capture steps in Always On availability group data movement under certain workloads. support.microsoft.com
3. Fixes an issue in which some availability group (AG) databases are in a non-synchronized state after the Windows Server Failover Clustering (WSFC) quorum loss. support.microsoft.com
4. Fixes an issue that causes database corruption if a system failure with alternatewritethrough mode occurs. support.microsoft.com
5. Fixes an issue in which running queries with columnstore indexes is stuck because of non-yielding scheduler errors. support.microsoft.com
6. Fixes various assertion failures (for example, Location: sosmerge.cpp:2930; Expression: mrP->mrpgcnt > 0) that you might encounter when building an index in simple or bulk-logged recovery models with indirect checkpoints because of missing flushes of intermediate data pages. support.microsoft.com
7. Fixes an issue in which remote code executions might be performed by using a dynamic-link library (DLL) planting technique on a SQL Server instance. support.microsoft.com
8. Fixes an issue in which a vulnerability in a SQL Server assembly might allow remote code execution. support.microsoft.com
9. Queries that use the built-in SESSION_CONTEXT function might return incorrect results or trigger access violation (AV) dump files when run in parallel query plans. support.microsoft.com

Checked automatically: 8 of 8 checks passed, 9 quoted passages · compared with Microsoft's page on Oct 21, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 3/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake