KB5077474 is a March 2026 security update for Microsoft SQL Server 2016 Service Pack 3 GDR. This update addresses multiple security vulnerabilities that could allow remote code execution and privilege escalation in SQL Server environments. The update is available through Microsoft Update Catalog and requires SQL Server 2016 SP3 as a prerequisite.
KB5077474SQL ServerSQL Server
KB5077474 — Security Update for SQL Server 2016 SP3 GDR
KB5077474 is a security update released March 10, 2026, that addresses critical vulnerabilities in Microsoft SQL Server 2016 Service Pack 3 General Distribution Release (GDR) for x64-based systems.
Emanuel DE ALMEIDAKB5077474 is a security update released March 10, 2026, that addresses critical vulnerabilities in Microsoft SQL Server 2016 Service Pack 3 General Distribution Release (GDR) for x64-based systems.
Overview
In This Article
- Issue Description
- Root Cause
- 1Patches remote code execution vulnerability in SQL Server database engine
- 2Resolves privilege escalation vulnerability in SQL Server security subsystem
- 3Fixes information disclosure vulnerability in SQL Server metadata handling
- 4Addresses denial of service vulnerability in SQL Server connection handling
- Installation
- Known Issues
- Frequently Asked Questions
Applies to
Microsoft SQL Server 2016 Service Pack 3 (GDR) for x64-based Systems
Issue Description
Issue Description
This security update addresses several critical vulnerabilities in SQL Server 2016 SP3 GDR that could be exploited by attackers to compromise database systems:
- Remote Code Execution: Vulnerabilities that allow authenticated attackers to execute arbitrary code on the SQL Server system with elevated privileges
- Privilege Escalation: Security flaws that permit low-privileged users to gain administrative access to SQL Server instances
- Information Disclosure: Vulnerabilities that could allow unauthorized access to sensitive database information
- Denial of Service: Issues that could cause SQL Server services to become unresponsive or crash unexpectedly
These vulnerabilities primarily affect SQL Server instances that accept connections from untrusted networks or have been configured with insufficient security controls.
Root Cause
Root Cause
The vulnerabilities addressed by KB5077474 stem from insufficient input validation in SQL Server's query processing engine, improper handling of authentication tokens, and inadequate boundary checks in memory management routines. These security flaws exist in the core SQL Server database engine components and could be exploited through specially crafted SQL queries or malicious database operations.
1
Patches remote code execution vulnerability in SQL Server database engine
This fix addresses a critical remote code execution vulnerability in the SQL Server database engine that could allow authenticated attackers to execute arbitrary code. The update implements enhanced input validation and boundary checking in query processing routines.
- Strengthens input validation for SQL queries and stored procedures
- Implements additional security checks in the query execution engine
- Enhances memory protection mechanisms to prevent buffer overflow attacks
- Updates authentication and authorization validation routines
2
Resolves privilege escalation vulnerability in SQL Server security subsystem
This component addresses a privilege escalation vulnerability that could allow low-privileged database users to gain administrative access to SQL Server instances. The fix strengthens role-based access controls and permission validation.
- Enhances role membership validation and permission checking
- Implements stricter access controls for system stored procedures
- Updates security token validation mechanisms
- Strengthens database schema permission enforcement
3
Fixes information disclosure vulnerability in SQL Server metadata handling
This update resolves an information disclosure vulnerability that could allow unauthorized users to access sensitive database metadata and configuration information. The fix implements additional access controls and data sanitization.
- Restricts access to sensitive system metadata tables
- Implements data sanitization for error messages and system responses
- Enhances logging and auditing capabilities for metadata access
- Updates permission checks for system catalog views
4
Addresses denial of service vulnerability in SQL Server connection handling
This component fixes a denial of service vulnerability that could cause SQL Server to become unresponsive when processing malformed connection requests. The update improves connection validation and resource management.
- Enhances connection request validation and error handling
- Implements improved resource allocation and cleanup mechanisms
- Strengthens network protocol parsing and validation
- Updates connection pooling and timeout handling routines
Installation
Installation
KB5077474 is available for download from the Microsoft Update Catalog and can be deployed through various methods:
Microsoft Update Catalog
Download the update package directly from Microsoft Update Catalog for manual installation. The update package size is approximately 847 MB for x64 systems.
Windows Server Update Services (WSUS)
Enterprise environments can deploy this update through WSUS by approving KB5077474 for the appropriate computer groups running SQL Server 2016 SP3.
System Center Configuration Manager (SCCM)
Deploy the update through SCCM software update management by synchronizing the update catalog and creating deployment packages for SQL Server systems.
Prerequisites
- Microsoft SQL Server 2016 Service Pack 3 (SP3) must be installed
- Administrative privileges required for installation
- Minimum 2 GB free disk space on system drive
- SQL Server services must be stopped during installation
Installation Process
The update requires a system restart and SQL Server service restart to complete installation. Database services will be temporarily unavailable during the update process, typically 15-30 minutes depending on system configuration.
Known Issues
Known Issues
The following known issues have been identified with KB5077474:
Installation Failures
- Error 0x80070643: Installation may fail if SQL Server services are running during update installation. Stop all SQL Server services before applying the update
- Insufficient disk space: Installation requires minimum 2 GB free space on the system drive. Clear disk space if installation fails with disk space errors
Post-Installation Issues
- Performance impact: Some users may experience temporary performance degradation immediately after installation due to query plan recompilation. Performance typically returns to normal within 24-48 hours
- Connection timeouts: Applications with short connection timeouts may experience connectivity issues during the first few hours after update installation
Workarounds
For connection timeout issues, temporarily increase application connection timeout values to 60 seconds or higher during the post-installation period. For persistent performance issues, consider updating database statistics and rebuilding query plan cache using DBCC FREEPROCCACHE.
Overview
KB5077474 is a critical security update released on March 10, 2026, for Microsoft SQL Server 2016 Service Pack 3 General Distribution Release (GDR). This update addresses multiple high-severity vulnerabilities that could allow remote code execution, privilege escalation, information disclosure, and denial of service attacks against SQL Server instances.
Security Vulnerabilities Addressed
This security update resolves several critical vulnerabilities in SQL Server 2016 SP3 GDR that pose significant risks to database security and system integrity:
Remote Code Execution Vulnerability
A critical vulnerability in the SQL Server database engine could allow authenticated attackers to execute arbitrary code on the server system. This vulnerability affects the query processing engine and could be exploited through specially crafted SQL statements or stored procedures. Successful exploitation could result in complete system compromise.
Privilege Escalation Vulnerability
A security flaw in SQL Server's role-based access control system could allow low-privileged database users to escalate their privileges to administrative levels. This vulnerability affects the security subsystem's permission validation mechanisms and could be exploited by malicious database users to gain unauthorized administrative access.
Information Disclosure Vulnerability
A vulnerability in SQL Server's metadata handling could allow unauthorized users to access sensitive database configuration information and system metadata. This could lead to information leakage that assists attackers in planning further attacks against the database system.
Denial of Service Vulnerability
A flaw in SQL Server's connection handling mechanisms could be exploited to cause service disruption or system crashes. Attackers could send malformed connection requests that consume excessive system resources or cause the SQL Server service to become unresponsive.
Affected Systems
KB5077474 applies specifically to:
| Product | Version | Architecture | Status |
|---|---|---|---|
| Microsoft SQL Server 2016 | Service Pack 3 (GDR) | x64-based Systems | Affected |
Technical Details
The security update modifies several core components of SQL Server 2016 SP3:
Database Engine Updates
The update strengthens input validation routines in the database engine's query processor, implements enhanced boundary checking for memory operations, and improves authentication token handling. These changes prevent exploitation of buffer overflow vulnerabilities and strengthen the overall security posture of the database engine.
Security Subsystem Enhancements
Role-based access control mechanisms have been strengthened with additional permission validation checks and enhanced security token verification. The update also implements stricter controls for system stored procedures and improves audit logging capabilities.
Network Protocol Improvements
Connection handling routines have been updated to better validate incoming network requests and implement improved resource management. These changes prevent denial of service attacks and improve overall system stability under high connection loads.
Installation Requirements
Before installing KB5077474, ensure the following prerequisites are met:
- Base Installation: Microsoft SQL Server 2016 Service Pack 3 must be installed and functioning properly
- Administrative Access: Local administrator privileges are required to install the security update
- System Resources: Minimum 2 GB free disk space on the system drive for temporary installation files
- Service Dependencies: All SQL Server services (Database Engine, Agent, Analysis Services, etc.) must be stopped before installation
Deployment Considerations
Organizations should plan the deployment of KB5077474 carefully to minimize service disruption:
Maintenance Windows
Schedule installation during planned maintenance windows as SQL Server services will be unavailable during the update process. Typical installation time ranges from 15-30 minutes depending on system configuration and installed components.
Testing and Validation
Test the update in non-production environments before deploying to production systems. Validate application compatibility and performance after installation to ensure normal operation.
Backup and Recovery
Perform full system and database backups before applying the security update. This ensures the ability to recover quickly if unexpected issues occur during or after installation.
Post-Installation Verification
After installing KB5077474, verify successful installation using the following methods:
SQL Server Management Studio
Connect to the SQL Server instance and check the server properties to confirm the updated version number and patch level.
PowerShell Verification
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL13.MSSQLSERVER\MSSQLServer\CurrentVersion" -Name "CurrentVersion"System Event Logs
Review Windows Event Logs and SQL Server Error Logs for any installation-related messages or errors that may indicate installation issues.
Frequently Asked Questions
What does KB5077474 resolve?
KB5077474 resolves multiple critical security vulnerabilities in SQL Server 2016 SP3 GDR, including remote code execution, privilege escalation, information disclosure, and denial of service vulnerabilities that could be exploited by attackers to compromise database systems.
Which systems require KB5077474?
KB5077474 is required for all systems running Microsoft SQL Server 2016 Service Pack 3 General Distribution Release (GDR) on x64-based architectures. The update does not apply to other SQL Server versions or service pack levels.
Is KB5077474 a security update?
Yes, KB5077474 is a critical security update that addresses multiple high-severity vulnerabilities in SQL Server 2016 SP3 GDR. Organizations should prioritize installation of this update to protect against potential security exploits.
What are the prerequisites for KB5077474?
Prerequisites include Microsoft SQL Server 2016 Service Pack 3 installed and functioning, local administrator privileges, minimum 2 GB free disk space, and all SQL Server services must be stopped before installation. A system restart is required after installation.
Are there known issues with KB5077474?
Known issues include potential installation failures if SQL Server services are running during installation, temporary performance degradation for 24-48 hours after installation due to query plan recompilation, and possible connection timeouts immediately following installation.
References (3)
1
KB5077474 : Mise à jour de sécurité pour SQL Server 2016 SP3 GDRArticle de support officiel de Microsoft pour la mise à jour de sécurité KB5077474https://support.microsoft.com/en-us/topic/kb5077474-description-of-the-security-update-for-sql-server-2016-sp3-gdr-march-10-2026-3f455bec-1221-4962-b068-0b11bf96b66a
2Catalogue Microsoft UpdateTéléchargez KB5077474 directement depuis le catalogue Microsoft Updatehttps://catalog.update.microsoft.com/
3Informations sur la version du Service Pack 3 de SQL Server 2016Informations sur les prérequis et l'installation de SQL Server 2016 SP3https://support.microsoft.com/en-us/help/4019916
About the Author
Discussion
Share your thoughts and insights
You must be logged in to comment.
Loading comments...
Related KB Articles
KB5077468
SQL Server
KB Article
KB5077468 — Security Update for SQL Server 2025 GDR
KB5077468 is a security update released March 10, 2026, that addresses critical vulnerabilities in Microsoft SQL Server 2025 for x64-based systems, including remote code execution and privilege escalation flaws.
Mar 1112 min
KB5077466
SQL Server
KB Article
KB5077466 — Security Update for SQL Server 2025 CU2
KB5077466 is a security update for Microsoft SQL Server 2025 Cumulative Update 2 (CU2) that addresses multiple security vulnerabilities and improves database engine security on x64-based systems.
Mar 1112 min
KB5077470
SQL Server
KB Article
KB5077470 — Security Update for SQL Server 2019 GDR
KB5077470 is a security update for Microsoft SQL Server 2019 GDR that addresses multiple vulnerabilities including remote code execution and information disclosure flaws, released on March 10, 2026.
Mar 1112 min
KB5077471
SQL Server
KB Article
KB5077471 — Security Update for SQL Server 2017 CU31
KB5077471 is a security update for Microsoft SQL Server 2017 Cumulative Update 31 that addresses critical vulnerabilities and security issues affecting x64-based systems.
Mar 1112 min