This fix addresses a security vulnerability in Microsoft Entra authentication login handling in SQL Server.

This fix addresses a remote code execution vulnerability in which a user who has administrative permissions modifies PolyBase service command-line parameters to activate a deprecated feature that runs the Data Warehouse (DW) Engine and Data Movement Service (DMS) control and data channels on raw Transmission Control Protocol (TCP) listeners. This deprecated feature is intended to run under a single SQL Platform Abstraction Layer (SQLPAL) instance in Kubernetes by having only the SQL Server port exposed outside the pod. The fix prevents PolyBase services from opening raw TCP listeners for the DW Engine and DMS control and data channels if the services start by having modified command-line parameters.

This fix addresses validation of malformed Tabular Data Stream (TDS) and Binary XML input processed by SQL Server components. The input contains invalid length values that can cause unexpected behavior.