Microsoft has published SQL Server 2025 CU3 + GDR (KB5083245), which updates SQL Server to build 17.0.4030.1. The release contains 2 fixes and is described as a security update that resolves vulnerabilities. It also includes a documented known issue for some linked server queries that use MSDASQL.
Improvements and fixes
This release centers on two security-related fixes in the SQL Server engine:
- Linked Server on Linux and Windows: fixes an elevation of privilege vulnerability in SQL Server linked servers, where a low-privileged SQL Server user could gain sysadmin permissions. Microsoft tracks this as bug 5063803.
- SQL Agent on Windows: fixes an issue involving improper neutralization of special elements in SQL commands, where SQL injection could allow an authorized attacker to elevate privileges over a network. Microsoft tracks this as bug 5052472.
Microsoft also states that this update contains fixes and resolves vulnerabilities, and the release notes reference the following advisories:
- CVE-2026-32167
- CVE-2026-32176
Known issues
Microsoft documents one known issue with this release:
- Linked server queries that use MSDASQL with a provider string can fail with Msg 7416: "Access to the remote server is denied because no login-mapping exists." Microsoft says a stricter connection validation check in the Database Engine can reject certain linked server configurations that use the MSDASQL (OLE DB Provider for ODBC Drivers) provider, even if earlier builds allowed them.
Microsoft points readers to a separate article for more information and workarounds. If this issue is later removed from the source, that removal alone does not prove it has been resolved.