Security Update for SQL Server 2016 SP2 GDR (KB5014365)

Data can be sent over a network to an affected Microsoft SQL Server instance that might cause code to run against the SQL Server process if a certain extended event is enabled.

More information about the vulnerability can be found here: KB5014365

For other impacted SQL Server releases, please see:

Security Update for SQL Server 2014 SP3 CU (CU4+GDR fix)*
Security Update for SQL Server 2014 SP3 GDR
Security Update for SQL Server 2016 SP2 CU (CU17+GDR fix)*
Security Update for SQL Server 2016 SP2 GDR
Security Update for SQL Server 2016 SP3 GDR
Security Update for SQL Server 2016 Azure Connect Feature Pack GDR
Security Update for SQL Server 2017 RTM CU (CU29+GDR fix)*
Security Update for SQL Server 2017 RTM GDR
Security Update for SQL Server 2019 RTM CU (CU16+GDR fix)*
Security Update for SQL Server 2019 RTM GDR
* These security updates are for SQL Server instances that have applied a Cumulative Update.

For a complete listing of the issues resolved in this update, see the associated Microsoft Knowledge Base article.

Supported Operating Systems

Windows 10

This update is applicable to SQL Server 2016 SP2 instances installed on supported Windows operating systems.

This update refreshes Microsoft SQL Server 2016 SP2 Windows that have NOT had a Cumulative Update applied (versions 13.0.5026.0 to 13.0.5103.6).

For Microsoft SQL Server 2016 SP2 for Windows (versions 13.0.5149.0 (CU1) to 13.0.5888.11(CU17)) that have had any Cumulative Update applied, please see KB5014351. After you install this update, you may have to restart your computer.