Skip to the content
The Update Bureau
SQL Server 2022 CU27 SQL Server 2022 CU27 Cumulative update

KB5104824

KB5104824: Cumulative update for SQL Server 2022, CU branch, September 2026. New multi-database link mode; recovery queries can trigger access violations

In short

Adds a multi-database link mode and includes 42 fixes. Open issues include incorrect SESSION_CONTEXT results in parallel plans and access violations during database recovery.

Does it affect you? Applies to: Instances running SQL Server 2022. The package updates the SQL Server components installed on the instance, and the update applies to all supported languages.

Build
16.0.4295.3
Servicing branch
CU
Restart
Required

For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?

What changes

Fixes 27 changes

Storage Management

  • Rolling back a user transaction no longer causes the described database corruption when Accelerated Database Recovery is disabled.1
    Fixes a rare rollback issue that could produce Page Free Space (PFS) page errors reported by DBCC CHECKDB when Accelerated Database Recovery (ADR) is disabled.

Backup Restore

For: Windows SQL Server administrators

  • Restoring a database with WITH MOVE using Volume Shadow Copy Service is less likely to take a long time or time out on servers with hundreds of databases.2

Security Infrastructure

5 items
  • Creating a database user no longer fails with character-mapping or token errors when the display name contains unsupported Kanji or other Unicode characters.3
    Applies when the system default code page doesn't support the characters in the user's display name.
  • A security vulnerability in handling sign-in requests that use Microsoft Entra authentication is fixed.7
  • Creating a database user from Microsoft Entra ID no longer fails with certain unsupported Unicode display names when using WITH OBJECT_ID.8
    The system default code page might not support Kanji or other Unicode characters in the display name.
  • Applicable audit records consistently include sensitivity information.21
    Fixes inconsistent population of the data_sensitivity_information field for records generated by the SCHEMA_OBJECT_ACCESS_GROUP audit action group.
  • A class ID lookup in enclave code no longer reads arbitrary memory.22

Management Services

Verified in package 2 items
  • A vulnerability in the SQL Server-managed backup stored procedures is fixed.4
    Applies to managed_backup.sp_get_encryption_option and managed_backup.sp_do_backup; customers using managed backup should apply the update through the standard SQL Server servicing process.
  • An issue affecting SQL Server Agent security and reliability under certain operating conditions is fixed.10

Linux

For: Linux SQL Server administrators

  • A timing-dependent race condition during exception handling on SQL Server for Linux is fixed.5
    The issue occurs during interrupt delivery while SQL Server on Linux handles exceptions.

SQL Server WMI Provider

For: Windows SQL Server administrators

  • The SQL Server WMI provider handles malformed input correctly while preserving its behavior for valid input.6

High Availability and Disaster Recovery

For: SQL Server administrators using availability groups

  • A secondary replica can join an availability group with a 64-character name and cluster type NONE or EXTERNAL.9

In-Memory OLTP

3 items

For: SQL Server administrators using In-Memory OLTP

  • SUBSTRING no longer reads beyond its allocated buffer for the described malformed value in a natively compiled stored procedure.11
    Applies to malformed DBCS varchar values.
  • Converting or truncating certain nvarchar values no longer causes an access violation that can end the SQL Server process.12
    Applies to values containing an ideographic variation sequence under a variation selector sensitive (_VSS) collation in a natively compiled stored procedure.
  • Streaming certain nvarchar(max) data no longer causes a heap buffer overwrite or makes the server stop responding.13
    The issue involves a variation selector sensitive (_VSS) collation in a natively compiled stored procedure, when TEXTSIZE truncates data and small Tabular Data Stream (TDS) packet sizes are used.

PolyBase

For: SQL Server administrators using PolyBase

  • Starting PolyBase services with modified command-line parameters no longer opens the described raw TCP listener for the DW Engine and DMS channels.14
    The affected channels are the DW Engine and DMS control and data channels.

XML

3 items
  • The xml data type handles DTD attribute lists correctly.15
    Fixes an issue in handling DTD attribute lists for the xml data type.
  • A query with an extremely large OPTION (USE PLAN) XML declaration no longer causes an access violation that can end the SQL Server process.16
  • Processing a specially crafted XML format file no longer causes the described integer overflow that could make SQL Server stop responding or end unexpectedly.20
    Applies when the file is processed through OPENROWSET(BULK ...) or BULK INSERT.

Programmability

3 items
  • The LEFT_SHIFT and RIGHT_SHIFT functions no longer have the described arithmetic overflow or out-of-bounds memory access that can end the SQL Server process.17
    The issue can occur with specially crafted shift values or binary input.
  • The SqlDataRecord.SetBytes API no longer has the described field-offset validation issue for sql_variant values.26
    Fixes improper field offset validation that could cause an out-of-bounds heap write when CLR integration is enabled.
  • An upgrade from SQL Server 2019 to SQL Server 2022 no longer stops responding during the replicated_model database upgrade phase on an instance hosting one or more contained availability groups.27

Extended Events

2 items
  • A security issue that could cause memory corruption through insufficient Extended Events validation is fixed.18
  • Several vulnerabilities that could disclose information or cause a denial of service when the Database Engine reads a specially crafted Extended Events file are fixed.19
    The affected files have the *.xel extension.

Query Optimizer

3 items
  • Input validation is strengthened for an issue that could let an authenticated user disclose a limited amount of memory.23
  • Input validation is strengthened for an issue that could let an authenticated user disclose in-memory information.24
  • Input validation is strengthened for a case where an authenticated user supplies a pointer that SQL Server reads, which could cause dump-file generation or out-of-memory conditions.25
    The pointer is dereferenced and read, but not executed.

Improvements 14 changes

Backup Restore

For: Windows SQL Server administrators

  • Backup metadata that is malformed or too small is rejected safely.28
    Improves validation of metadata processed by the SQL Server VSS Writer.

SQL Agent

Verified in package

For: Windows SQL Server administrators

  • Security validation improves when SQL Server Agent loads task agent components.29

Management Services

Verified in package
  • SQL Server Agent is more reliable and secure when processing certain input.30

PolyBase

For: SQL Server administrators using PolyBase

  • Responses from S3-compatible external storage endpoints are validated more thoroughly during external data access.31

Programmability

  • SQL Server handles and outputs certain internal event data in a way that better protects information.32

Security Infrastructure

3 items

For: Windows SQL Server administrators

  • Embedded attestation fields are checked for valid bounds when parsed.33
    Adds bounds validation in sys.sp_describe_parameter_encryption.
  • Object Store Format data is better protected against malformed or malicious stream data.34
    Improves Object Store Format (OSF) deserialization.
  • Enclave code checks buffer lengths more thoroughly.35

Query Store

For: Windows SQL Server administrators

  • Showplan input is handled with improved security and reliability.36

Replication

5 items
  • Internal replication data is better protected during processing.37
  • Merge replication handles text data with improved security and reliability.38
  • Replication operations are validated and handled with improved security and reliability.39
  • Queued updating subscriptions in transactional replication have improved security and reliability.40
  • Queued updating subscriptions in transactional replication have improved security and reliability.41

New feature 1 change

High Availability and Disaster Recovery

For: SQL Server administrators using Managed Instance link

  • Managed Instance link can use multiple-database link mode to extend an existing availability group to Azure SQL Managed Instance and replicate or fail over the databases together.42
    Supports extending an existing Always On availability group containing multiple databases from SQL Server to Azure SQL Managed Instance.

Known issues

  1. Open Affects: Organizations and IT administrators

    Linked server queries that use MSDASQL fail with error 7416

    Linked-server queries using the MSDASQL provider and a provider string (@provstr) fail with error 7416, saying access is denied because no login mapping exists.43

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  2. Open Affects: Organizations and IT administrators

    Access violation when you query sys.dm_exec_requests during database recovery

    Queries against sys.dm_exec_requests might cause an access violation and dump file while a database is recovering, including during RESTORE, startup recovery, or before an availability group replica finishes coming online.44

    How to apply the workaround SQL Trace Flag

    Enable trace flag 4696, avoid querying sys.dm_exec_requests for databases that are recovering, or uninstall this update. With the trace flag enabled, monitoring queries against sys.dm_exec_requests or sys.sysprocesses on secondary replicas might return error 976 or 978.44

  3. Open Affects: Organizations and IT administrators

    Incorrect behavior of SESSION_CONTEXT in parallel plans

    Queries using SESSION_CONTEXT might return incorrect results or generate access violation dump files when run in parallel plans, particularly if the session is reset for reuse.45

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  4. Open Affects: Organizations and IT administrators

    Some Master Data Services features might not work as expected

    After installing this update, creating an entity or attribute in Master Data Services, or loading hierarchies in Explorer, might not work as expected.46

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-09-15
Classification
Updates
Type
Cumulative update
Servicing branch
CU
Restart
Required
Replaces
KB5093420, KB5081477, KB5080999, KB5078297
+12 earlier KB5068450, KB5065865, KB5059390, KB5054531, KB5050771, KB5048038, KB5048033, KB5041321, KB5038325, KB5036432, KB5033663, KB5032679
Replaced by
KB5126934
VersionBuildChannel
2022 16.0.4295.3 General availability

Security

No vulnerabilities are listed for this update.

Downloads (Microsoft Update Catalog)

Package 2022
467.8 MB
sqlserver2022-kb5104824-x64.exe Main update · KB5104824 SHA-1: 0eba1dc8…831552

Updated components

242 files changed since the previous update for the same versions.

Top changed componentsFiles
SQL Server Engine64
SQL Server Replication12
SQL Server Integration Services11
SQL Server Agent5
SQL Server Machine Learning Services4
SQL Server PolyBase4
SQL Server Full-Text Search2

Verified in package: changed files confirm Management Services, SQL Agent.

Sources

Updated
Cited passages from Microsoft's official notes (46)
  1. 1. Fixes a rare issue in which rolling back a user transaction causes database corruption that DBCC CHECKDB reports as Page Free Space (PFS) page errors if Accelerated Database Recovery (ADR) is disabled. support.microsoft.com
  2. 2. Fixes an issue in which restoring a database by using Volume Shadow Copy Service (VSS) and WITH MOVE takes a long time or times out if the server contains hundreds of databases. support.microsoft.com
  3. 3. Fixes an issue in which creating a database user fails and returns character mapping or token errors if the display name of the user contains Kanji or other Unicode characters that the system default code page doesn't support. support.microsoft.com
  4. 4. Fixes a vulnerability that affects the SQL Server-managed backup to Microsoft Azure stored procedures, managed_backup.sp_get_encryption_option and managed_backup.sp_do_backup. support.microsoft.com
  5. 5. Fixes a timing-dependent race condition that occurs during interrupt delivery while SQL Server on Linux handles exceptions. support.microsoft.com
  6. 6. Fixes an issue in which the SQL Server WMI provider processes malformed input incorrectly, while preserving the existing behavior for valid input. support.microsoft.com
  7. 7. Fixes a security vulnerability in the handling of sign-in requests that use Microsoft Entra authentication. support.microsoft.com
  8. 8. Fixes an issue in which creating a database user from Microsoft Entra ID by using the WITH OBJECT_ID option fails if the display name of the user contains Kanji or other Unicode characters that the system default code page doesn't support. support.microsoft.com
  9. 9. Fixes an issue in which a secondary replica fails to join an availability group that has a 64-character name and a cluster type of NONE or EXTERNAL. support.microsoft.com
  10. 10. Fixes an issue that affects the security and reliability of SQL Server Agent under certain operating conditions. support.microsoft.com
  11. 11. Fixes an issue in which the SUBSTRING function reads beyond the allocated buffer when it processes a malformed DBCS varchar value in a natively compiled stored procedure. support.microsoft.com
  12. 12. Fixes an access violation that causes the SQL Server process to end unexpectedly when an nvarchar value that contains an ideographic variation sequence is converted or truncated under a variation selector sensitive (_VSS) collation in a natively compiled stored procedure. support.microsoft.com
  13. 13. Fixes an issue in which streaming nvarchar(max) data under a variation selector sensitive (_VSS) collation in a natively compiled stored procedure causes a heap buffer overwrite or causes the server to stop responding. support.microsoft.com
  14. 14. Fixes an issue in which a raw TCP listener is opened for the DW Engine and DMS control and data channels when the PolyBase services are started by using modified command-line parameters. support.microsoft.com
  15. 15. Fixes an issue in the handling of DTD attribute lists for the xml data type. support.microsoft.com
  16. 16. Fixes an access violation that occurs if a query includes an extremely large OPTION (USE PLAN) XML declaration. This issue can cause the SQL Server process to end unexpectedly. support.microsoft.com
  17. 17. Fixes arithmetic overflow and out-of-bounds memory access in the LEFT_SHIFT and RIGHT_SHIFT functions when they process specially crafted shift values or binary input. support.microsoft.com
  18. 18. Fixes a security issue in SQL Server in which insufficient validation in Extended Events can cause memory corruption. support.microsoft.com
  19. 19. Fixes several security vulnerabilities that allow information disclosure or a denial of service if the Database Engine reads a specially crafted Extended Events (.xel) file. support.microsoft.com
  20. 20. Fixes an integer overflow in the XML reader that occurs if a specially crafted XML format file is processed through OPENROWSET(BULK ...) or BULK INSERT. support.microsoft.com
  21. 21. Fixes an issue in which the data_sensitivity_information field isn't consistently populated in audit records that are generated by the SCHEMA_OBJECT_ACCESS_GROUP audit action group. support.microsoft.com
  22. 22. Fixes an issue in which a class ID lookup in enclave code reads arbitrary memory. support.microsoft.com
  23. 23. Fixes an improper input validation issue in SQL Server that allows an authenticated user to disclose a limited amount of memory. This fix strengthens input validation. support.microsoft.com
  24. 24. Fixes an improper input validation issue in SQL Server that allows an authenticated user to disclose in-memory information. This fix strengthens input validation. support.microsoft.com
  25. 25. Fixes an improper input validation issue in SQL Server in which an authenticated user can provide a pointer that SQL Server dereferences and reads but does not execute. support.microsoft.com
  26. 26. Fixes improper field offset validation in the SqlDataRecord.SetBytes API for sql_variant values that can cause an out-of-bounds heap write if CLR integration is turned on. support.microsoft.com
  27. 27. Fixes an issue in which an upgrade from SQL Server 2019 to SQL Server 2022 stops responding during the replicated_model database upgrade phase on an instance that hosts one or more contained availability groups. support.microsoft.com
  28. 28. Improves the validation of backup metadata that the SQL Server VSS Writer processes so that malformed or undersized metadata is rejected safely. support.microsoft.com
  29. 29. Improves security validation when SQL Server Agent loads task agent components. support.microsoft.com
  30. 30. Improves the reliability and security of SQL Server Agent when it processes certain input. support.microsoft.com
  31. 31. Improves the validation of responses from S3-compatible external storage endpoints during external data access. support.microsoft.com
  32. 32. Improves the manner in which SQL Server processes and outputs certain internal event data to help better protect information. support.microsoft.com
  33. 33. Adds bounds validation for embedded attestation fields that are parsed by sys.sp_describe_parameter_encryption. support.microsoft.com
  34. 34. Improves Object Store Format (OSF) deserialization to protect against malformed or malicious stream data. support.microsoft.com
  35. 35. Improves buffer length validation in enclave code. support.microsoft.com
  36. 36. Improves the handling of Showplan input to enhance security and reliability. support.microsoft.com
  37. 37. Improves the protection of internal replication data during processing operations. support.microsoft.com
  38. 38. Improves the handling of text data in merge replication to enhance security and reliability. support.microsoft.com
  39. 39. Improves the validation and handling of replication operations to enhance security and reliability. support.microsoft.com
  40. 40. Improves the security and reliability of queued updating subscriptions in transactional replication. support.microsoft.com
  41. 41. Improves the security and reliability of queued updating subscriptions in transactional replication. support.microsoft.com
  42. 42. Adds multiple-database link mode for the Managed Instance link. You can use this mode to extend an existing Always On availability group that contains multiple databases from SQL Server to Azure SQL Managed Instance and to replicate and fail over those databases together. support.microsoft.com
  43. 43. Linked server queries that use the MSDASQL (OLE DB Provider for ODBC Drivers) provider and specify a provider string (@provstr) fail and return the following error message: support.microsoft.com
  44. 44. Enable trace flag 4696 to opt out of the code change that causes this issue. If you enable this trace flag, monitoring queries that query sys.dm_exec_requests or sys.sysprocesses on secondary replicas might return error 976 or error 978, as they did before you installed this update. support.microsoft.com
  45. 45. Queries that use the built-in SESSION_CONTEXT function might return incorrect results or trigger access violation (AV) dump files when run in parallel query plans. support.microsoft.com
  46. 46. After you install this update, the following Master Data Services (MDS) functionality might not load or work as expected: support.microsoft.com
Checked automatically: 8 of 8 checks passed, 46 quoted passages · compared with Microsoft's page on Nov 14, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake