Microsoft has published SQL Server 2022 CU25 + GDR (KB5101347), updating the product to build 16.0.4262.2. The release bundles four verified fixes and addresses several security-related issues across the engine and Integration Services.

This update is described as a security update that contains fixes and resolves vulnerabilities.

Known issues

One known issue is documented in this release:

  • Linked server queries that use MSDASQL can fail with error 7416 when a provider string (@provstr) is specified. Microsoft says a stricter connection validation check in the Database Engine can reject some linked server configurations that use the MSDASQL (OLE DB Provider for ODBC Drivers) provider, even if earlier builds allowed them.

Microsoft notes that more information and workarounds are available in its linked server issue article. If an issue is removed from the source later, that removal does not by itself prove it has been resolved.

Improvements and fixes

Microsoft lists 4 fixes in this release. The changes are spread across the SQL Server Engine and Integration Services:

  • Integration Services: A fix for an insecure deserialization issue in MessageQueueTask limits SoapFormatter deserialization with an allow-list binder, preventing remote code execution from untrusted MSMQ messages. Bug reference: 5340801.
  • Query execution: A memory leak that could occur when using sys.dm_exec_input_buffer or DBCC INPUTBUFFER has been fixed. Bug reference: 5337383.
  • Replication: Input validation and sanitization were added for a parameter passed to an internal replication stored procedure. Bug reference: 5336750.
  • SQL Agent: A SQL injection issue was addressed in SQL Server where improper neutralization of special elements in commands could allow an authenticated attacker to elevate privileges over the network. Bug reference: 5263358.

What changed in this release

For DBAs and application teams, the main points are straightforward:

  • SQL Server 2022 is now at 16.0.4262.2.
  • The update includes security-related fixes across multiple components.
  • Microsoft also documents one linked server issue with MSDASQL and Msg 7416 that admins may want to review when validating linked server configurations.

The update applies to SQL Server 2022 and is identified by KB5101347.

Official source