KB5129299 - Description of the security update for SQL Server 2025 CU10: November 10, 2026

Applies To

SQL Server 2025 on Windows (all editions), SQL Server 2025 on Linux (all editions)

Release date: November 10, 2026

Version: 17.0.5045.3

Summary

This security update contains fixes and resolves vulnerabilities. To learn more about the vulnerabilities, see the following security advisories:

The Microsoft SQL Server components are updated to the following builds in this security update:

  • SQL Server - product version: 17.0.5045.3, file version: 2025.170.5045.3

Important

To help secure SQL Server on Windows, enable encryption with Extended Protection.

Known issues in this update

Access violation when you query sys.dm_exec_requests during database recovery

Queries against sys.dm_exec_requests might raise an access violation and generate a dump file if they run while a database is still recovering. This issue can occur during a database RESTORE operation, during startup recovery, or before an availability group replica finishes coming online.

The SQL Server error log contains entries that resemble the following text:

The database '<DatabaseName>' is marked RESTORING and is in a state that does not allow recovery to be run.
***Stack Dump being sent to <SQLServerLogFolder>\SQLDump0215.txt
SqlDumpExceptionHandler: Process 77 generated fatal exception c0000005 EXCEPTION_ACCESS_VIOLATION. SQL Server is terminating this process.
*******************************************************************************

BEGIN STACK DUMP:
  07/30/26 07:37:23 spid 77

Exception Address = <frame id="00" address="0x7FFDED94970D" pdb="sqlmin.pdb" age="2" guid="E1039014-237E-4DB6-88FD-4A2AB31C651F" module="sqlmin" rva="0x2970D" />
Exception Code    = c0000005 EXCEPTION_ACCESS_VIOLATION
Access Violation occurred reading address 00000000000000F0
Input Buffer <size> bytes -
          <dbo.sp_YourMonitoringStoredProcedure>

This issue occurs because of a change that causes internal in-memory structures to be referenced before they're fully initialized.

Microsoft is aware of this issue and is investigating a fix. Until a fix is available, use one of the following mitigations:

  • Enable trace flag 4696 to opt out of the code change that causes this issue. If you enable this trace flag, monitoring queries that query sys.dm_exec_requests or sys.sysprocesses on secondary replicas might return error 976 or error 978, as they did before you installed this update.
  • Avoid queries against sys.dm_exec_requests for databases that are recovering.
  • Uninstall this update.

Improvements and fixes included in this update

A downloadable Excel workbook that contains a summary list of builds, together with their current support lifecycle, is available. The Excel file also contains detailed fix lists. Download this Excel file now.

Note

Individual entries in the following table can be referenced directly through a bookmark. If you select any bug reference ID in the table, a bookmark tag is added to the URL by using the "#bkmk_NNNNNNN" format. You can then share this URL with others so that they can jump directly to the desired fix in the table.

Bug reference Description Fix area Component Platform
5270200 Fixes an out-of-bounds memory read action that can occur during processing of certain client connection requests. SQL Connectivity SQL Connectivity Linux, Windows
5270275 Fixes a heap buffer overflow during XML operation. SQL Server Engine Programmability Linux, Windows
5585868 Fixes an issue in which permissions aren't cleaned up correctly if EXTERNAL MODEL objects are dropped. SQL Server Engine Extensibility Linux, Windows
5596482 Fixes an out-of-bounds memory read action that can occur during processing of certain client connection requests. SQL Connectivity SQL Connectivity Linux, Windows
5622175 Fixes a heap buffer overflow during XML operation. SQL Server Engine Programmability Linux, Windows
5622469 Fixes a memory corruption issue in XA distributed transaction processing. SQL Server Engine Transaction Services Windows
5623596 Fixes an access violation that can occur if JSON functions process a path that has more than 128 nesting levels. SQL Server now returns an error instead of crashing. SQL Server Engine Programmability Linux, Windows
5623598 Fixes an issue in which merging JSON array data can cause data corruption or an unexpected SQL Server dump file. SQL Server Engine Programmability Linux, Windows
5623599 Fixes an issue in which merging JSON array data can cause data corruption or an unexpected SQL Server dump file. SQL Server Engine Programmability Linux, Windows
5623602 Fixes an issue in which JSON_VALUE can include unintended memory content in a conversion error message if it's used together with RETURNING and multibyte UTF-8 input. SQL Server Engine Programmability Windows
5623603 Fixes an issue in which JSON_VALUE can include unintended memory content in a conversion error message if it's used together with RETURNING and multibyte UTF-8 input. SQL Server Engine Programmability Windows
5623673 Disables XSLT scripting by default. To restore previous behavior, set EnableXsltScript to 1 under HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\{version}\SSIS\XMLTask. Integration Services Integration Services Windows
5624036 Fixes a memory access violation that might occur when you use the Raw File source component of SQL Server Integration Services. Integration Services Integration Services Windows
5624079 Fixes an integer overflow that can cause memory access issues in the HTTP connection manager of SQL Server Integration Services. Integration Services Integration Services Windows
5624099 Fixes an out-of-bounds read action in log block record parsing. SQL Server Engine Security Infrastructure Windows
5624143 Fixes a memory access violation that might occur when you use the Raw File source component of SQL Server Integration Services. Integration Services Integration Services Windows
5624538 Improves security for index operations in SQL Server. SQL Server Engine Methods to access stored data Windows
5624551 Fixes an issue in which querying a database that contains a corrupted row-compressed record can return unintended memory content. SQL Server now returns a database corruption error message instead. SQL Server Engine Access Methods Windows
5624572 Improves security for transaction logging in SQL Server. SQL Server Engine Methods to access stored data Windows
5624875 Improves validation of sparse column data in SQL Server to enhance security and reliability. SQL Server Engine Access Methods Windows
5624925 Improves security for transaction logging in SQL Server. SQL Server Engine Column Stores Windows
5624948 Improves the validation of variable-length column offsets if SQL Server processes database records. SQL Server Engine Methods to access stored data Windows
5624992 Strengthens database metadata validation in SQL Server. SQL Server Engine Methods to access stored data Windows
5632688 Improves the security and reliability of replication security metadata handling during subscriber database restore and upgrade operations. SQL Server Engine Replication Windows
5632690 Improves the security and reliability of replication security metadata handling during subscriber database restore and upgrade operations. SQL Server Engine Replication Windows
5632806 Improves the security and reliability of the Log Reader Agent in heterogeneous transactional replication scenarios. SQL Server Engine Replication Windows
5632808 Improves the security and reliability of the Log Reader Agent in heterogeneous transactional replication scenarios. SQL Server Engine Replication Windows
5632819 Improves the security and reliability of the change feed configuration. SQL Server Engine Replication Windows
5632821 Improves the security and reliability of the change feed configuration. SQL Server Engine Replication Windows
5632854 Fixes a buffer overflow that occurs if merge replication processes more than 250 WebSync XML nickname entries. SQL Server Engine Replication Linux, Windows
5632856 Fixes a buffer overflow that occurs if merge replication processes more than 250 WebSync XML nickname entries. SQL Server Engine Replication Linux, Windows
5632880 Addresses an issue in replication operations that affects data validation. SQL Server Engine Replication Linux, Windows
5632882 Addresses an issue in replication operations that affects data validation. SQL Server Engine Replication Linux, Windows
5632893 Addresses an issue in Merge Replication Web Synchronization operations that affects data validation. SQL Server Engine Replication Linux, Windows
5632895 Addresses an issue in Merge Replication Web Synchronization operations that affects data validation. SQL Server Engine Replication Linux, Windows
5632906 Addresses an issue in Change Event Streaming input data processing. SQL Server Engine Replication Linux, Windows
5632908 Addresses an issue in Change Event Streaming input data processing. SQL Server Engine Replication Linux, Windows
5632933 Strengthens authorization checks for certain replication-related database operations to prevent unintended disclosure of database information. SQL Server Engine Replication Windows
5632935 Strengthens authorization checks for certain replication-related database operations to prevent unintended disclosure of database information. SQL Server Engine Replication Windows
5635192 Strengthens security validation for stored procedures that are used by merge replication. SQL Server Engine Replication Windows
5635970 Fixes a security vulnerability that allows information disclosure or a denial of service if the SQL Database Engine reads a specially crafted SQL Trace file. SQL Server Engine Programmability Linux, Windows
5635973 Fixes a security vulnerability that allows information disclosure or a denial of service if the SQL Database Engine reads a specially crafted SQL Trace file. SQL Server Engine Programmability Linux, Windows
5636117 Improves input validation for transaction identifiers that replication processes. SQL Server Engine Replication Linux, Windows
5636120 Improves input validation for transaction identifiers that replication processes. SQL Server Engine Replication Linux, Windows
5636151 Improves memory safety if replication processes transaction identifiers. SQL Server Engine Replication Linux, Windows
5636153 Improves memory safety if replication processes transaction identifiers. SQL Server Engine Replication Linux, Windows
5641943 Improves the handling of object names in internal stored procedures. SQL Server Engine Management Services Linux, Windows
5645699 Improves the handling of database names in SQLdiag for long names and names that contain Unicode characters. SQL Server Client Tools SQLDiag Windows
5653492 Strengthens security validation for replication during database upgrades. SQL Server Engine Replication Windows
5653520 Improves the validation of conflict table names for transactional replication. SQL Server Engine Replication Windows
5653536 Improves the handling of column names in merge replication stored procedures. SQL Server Engine Replication Windows
5653569 Improves parameter validation for the Queue Reader Agent. SQL Server Engine Replication Windows
5653580 Improves identifier validation for transactional replication. SQL Server Engine Replication Windows
5653592 Improves the handling of conflict table names in merge replication. SQL Server Engine Replication Windows
5653623 Strengthens security validation for conflict reporting in merge replication. SQL Server Engine Replication Windows
5653637 Improves the validation of object names for schema changes in merge replication. SQL Server Engine Replication Windows
5653704 Improves the handling of table names in the generated procedures for merge replication. SQL Server Engine Replication Windows
5653716 Strengthens input validation for change processing in merge replication. SQL Server Engine Replication Windows
5653740 Improves security if transactional replication processes schema changes. SQL Server Engine Replication Windows
5653758 Strengthens security checks for lightweight merge replication operations. SQL Server Engine Replication Windows
5653801 Improves security validation for the processing of queued replication data. SQL Server Engine Replication Windows
5653819 Improves authorization validation for SQL Server Agent job steps. SQL Server Engine Management Services Windows
5653828 Strengthens role validation for replication subscription checks. SQL Server Engine Replication Windows
5654548 Improves the protection of replication data and operations. SQL Server Engine Replication Linux, Windows
5661334 Improves input validation for PolyBase stored procedures. SQL Server Engine PolyBase Linux, Windows
5723111 Strengthens security checks for linked server access in replication. SQL Server Engine Replication Linux, Windows
5723117 Fixes a heap buffer overflow that can occur in the Log Reader Agent. SQL Server Engine Replication Windows
5723142 Improves Merge Replication error-source parsing by adding bounded validation. SQL Server Engine Replication Windows
5723323 Improves input validation for Azure Synapse Link for SQL. SQL Server Engine Replication Linux, Windows
5723329 Fixes an information disclosure vulnerability in replication queue command decoding in xp_decodequeuecmd. SQL Server Engine Replication Windows
5723330 Fixes an issue in which malformed replication article metadata that has missing or sparse column ordinals can cause the Log Reader Agent to access invalid rowset bindings. SQL Server Engine Replication Windows

How to obtain and install the update

Method 1: Windows Update

This update is available through Windows Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to turn on automatic updating, see Windows Update: FAQ.

Method 2: Microsoft Update Catalog

To get the standalone package for this update, go to the Microsoft Update Catalog website.

Note

  • The detection logic has been updated for this and future security releases that are posted to the Microsoft Update Catalog website. For more information, see Updates to the Microsoft Update detection logic for SQL Server servicing.
  • This update is made available through the Microsoft Update Catalog for all servers that are running SQL Server, even if Power BI Report Server is not installed. Installing this security update is optional for computers that do not host Power BI Report Server. For more information, see Download Power BI Report Server.

Method 3: Microsoft Download Center

The following file is available for download from the Microsoft Download Center:

Download icon Download the package now

How to obtain or download the latest cumulative update package for Linux

To update SQL Server 2025 on Linux to the latest CU, you must first have the Cumulative Update repository configured. Then, update your SQL Server packages by using the appropriate platform-specific update command.

For installation instructions and direct links to the CU package downloads, see the SQL Server 2025 Release Notes.

More information

Prerequisites

To apply this update, you must have SQL Server 2025 or any SQL Server 2025 CU release through this SQL Server 2025 CU10 GDR installed.

Security update deployment information

For deployment information about this update, see Deployments - Security Update Guide.

File hash information

File name SHA256 hash
SQLServer2025-KB5129299-x64.exe 64AC66C63E7037F8578B3C2CB76D093E4E11F5D65951EC5545BE92AF44BEA190

File information

The English version of this package has the file attributes (or later file attributes) that are listed in the following worksheet. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it's converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

For all supported x64-based versions - Download the list of files that are included in security update 5129299.

Information about protection and security

Protect yourself online: Windows Security support

Learn how we guard against cyber threats: Microsoft Security