KB5102336: Security update for SQL Server 2019, GDR branch, July 2026. Critical remote-code flaw fixed; MSDASQL queries can fail

Fixes 4 vulnerabilities, including a Critical remote code execution flaw. Linked server queries using MSDASQL with a provider string might fail with error 7416.

Does it affect you? Applies to: SQL Server 2019 instances on the GDR branch. The update package is for supported x64-based versions.

For servers on the GDR branch: they get security fixes only. Servers that install cumulative updates (CU branch) get a separate update. Which branch am I on?

What changes

Fixes 4 changes

Integration Services

Untrusted MSMQ messages can no longer trigger remote code execution through insecure deserialization in MessageQueueTask.¹
Restricts SoapFormatter deserialization by using an allow list binder.

Query Execution

Using sys.dm_exec_input_buffer or DBCC INPUTBUFFER no longer causes a memory leak.²
Resolves a memory leak in the dynamic management function (DMF) sys.dm_exec_input_buffer and the DBCC INPUTBUFFER command.

Replication

Input passed to an internal replication stored procedure is validated and sanitized before the procedure uses it.³

SQL Agent

An SQL injection vulnerability that could let an authenticated attacker elevate privileges over a network is resolved.⁴
Improper neutralization of special elements in SQL Server commands could allow privilege elevation.

Known issues

Open Affects: Organizations and IT administrators

Linked server queries that use MSDASQL fail with error 7416

Linked server queries that use the MSDASQL provider and specify a provider string (@provstr) might fail with error 7416 because the Database Engine rejects some connection configurations.⁵

Workaround status No workaround yet

Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2026-07-14
Classification: Security Updates
Type: Cumulative update
Servicing branch: GDR
Restart: Required
Replaces: KB5090408, KB5084817, KB5077470, KB5068405

+8 earlier
KB5065223, KB5063758, KB5058713, KB5046859, KB5046056, KB5042214, KB5040986, KB5035434
Replaced by: KB5122773

Version	Build	Channel
2019	15.0.2180.2	General availability

Security

4 vulnerabilities fixed

1 critical 3 important

Vulnerability	Severity	CVSS
CVE-2026-54118 Microsoft SQL Server Remote Code Execution Vulnerability	Critical	9.8
CVE-2026-47295 Microsoft SQL Server Elevation of Privilege Vulnerability	Important	8.8
CVE-2026-55002 Microsoft SQL Server Elevation of Privilege Vulnerability	Important	8.8
CVE-2026-47296 Microsoft SQL Server Elevation of Privilege Vulnerability	Important	7.5

Downloads (Microsoft Update Catalog)

Package 2019

509.0 MB

sqlserver2019-kb5102336-x64.exe Main update · KB5102336 SHA-1: 9a52a3b5…04b70b

Updated components

156 files changed since the previous update for the same versions.

Top changed components	Files
SQL Server Engine	121
SQL Server PolyBase	5

Sources

Microsoft Support: KB5102336

Updated Oct 26, 2026

Cited passages from Microsoft's official notes (5)

1. This fix resolves an insecure deserialization vulnerability in MessageQueueTask by restricting SoapFormatter deserialization that uses an allow list binder. The restriction prevents remote code execution (RCE) from untrusted Microsoft Message Queuing (MSMQ) messages. support.microsoft.com
2. This fix resolves a memory leak that occurs if the sys.dm_exec_input_buffer dynamic management function (DMF) or the DBCC INPUTBUFFER command is used. support.microsoft.com
3. This fix addresses input validation and sanitization of user input for a parameter that's passed to an internal replication stored procedure by validating and sanitizing the input before the stored procedure uses it. support.microsoft.com
4. This fix resolves an SQL injection vulnerability in SQL Server in which improper neutralization of special elements in SQL Server commands allows an authenticated attacker to elevate privileges over a network. support.microsoft.com
5. Linked server queries that use the MSDASQL (OLE DB Provider for ODBC Drivers) provider and specify a provider string (@provstr) fail and return the following error message: support.microsoft.com

Checked automatically: 8 of 8 checks passed, 5 quoted passages · compared with Microsoft's page on Oct 16, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake