Release date: November 10, 2026
Version: 14.0.2150.2
- Summary
- Improvements and fixes included in this update
- How to obtain and install the update
- More information
- File information
- Information about protection and security
Summary
This security update contains fixes and resolves vulnerabilities. To learn more about the vulnerabilities, see the following security advisories:
- CVE-2026-118112 - Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-116934 - Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-116935 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-116942 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-94511 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-67387 - Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-118110 - Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-118114 - Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-118116 - Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-116929 - Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-118104 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-68781 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-66813 - Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-118113 - Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-116946 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-116945 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-116943 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-116930 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-67374 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-118103 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-116944 - Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-67382 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-116940 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-116939 - Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-116936 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-116941 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-67632 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-67637 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-118106 - Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-118109 - Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-67391 - Microsoft SQL Server Remote Code Execution Vulnerability
The Microsoft SQL Server components are updated to the following builds in this security update:
- SQL Server - product version: 14.0.2150.2, file version: 2017.140.2150.2
Important
To help secure SQL Server on Windows, enable encryption with Extended Protection.
Improvements and fixes included in this update
A downloadable Microsoft Excel workbook that contains a summary list of builds, together with their current support lifecycle, is available. The Excel file also contains detailed fix lists. Download this Excel file now.
Note
Individual entries in the following table can be referenced directly through a bookmark. If you select any bug reference ID in the table, a bookmark tag is added to the URL by using the "#bkmk_NNNNNNN" format. You can then share this URL with others so that they can jump directly to the desired fix in the table.
| Bug reference | Description | Fix area | Component | Platform |
|---|---|---|---|---|
| 5270205 | Fixes an out-of-bounds memory read action that can occur during processing of certain client connection requests. | Windows | ||
| 5500279 | Resolves several security vulnerabilities that allow information disclosure or a denial of service if the SQL Database Engine reads a specially crafted Extended Events (.xel) file. | |||
| 5572857 | Fixes a security vulnerability that allows information disclosure or a denial of service if the SQL Database Engine reads a specially crafted SQL Trace file. | SQL Server Engine | Windows | |
| 5622185 | Fixes a heap buffer overflow during XML operation. | SQL Server Engine | Programmability | |
| 5624087 | Fixes an out-of-bounds read action in log block record parsing. | SQL Server Engine | Windows | |
| 5624549 | Improves security for index operations in SQL Server. | SQL Server Engine | Windows | |
| 5624563 | Fixes an issue in which querying a database that contains a corrupted row-compressed record can return unintended memory content. SQL Server now returns a database corruption error message instead. | SQL Server Engine | Windows | |
| 5624591 | Improves security for transaction logging in SQL Server. | SQL Server Engine | Methods to access stored data | Windows |
| 5624897 | Improves validation of sparse column data in SQL Server to enhance security and reliability. | SQL Server Engine | Access Methods | Windows |
| 5624934 | Improves security for transaction logging in SQL Server. | SQL Server Engine | Column Stores | Windows |
| 5624965 | Improves the validation of variable-length column offsets if SQL Server processes database records. | SQL Server Engine | Windows | |
| 5625001 | Strengthens database metadata validation in SQL Server. | SQL Server Engine | Methods to access stored data | Windows |
| 5639369 | Fixes an issue in replication operations that affects data validation. | SQL Server Engine | Replication | Linux, Windows |
| 5639385 | Addresses an issue in Merge Replication Web Synchronization operations that affects data validation. | SQL Server Engine | Replication | Linux, Windows |
| 5639401 | Strengthens authorization checks for certain replication-related database operations to prevent unintended disclosure of database information. | SQL Server Engine | Replication | Linux, Windows |
| 5642394 | Improves the handling of object names in internal stored procedures. | SQL Server Engine | Linux, Windows | |
| 5644970 | Improves the security and reliability of the handling of replication security metadata during subscription database restore and upgrade operations. | SQL Server Engine | Replication | Windows |
| 5645009 | Improves the security and reliability of the Log Reader Agent in heterogeneous transactional replication scenarios. | SQL Server Engine | Replication | Windows |
| 5645704 | Improves the handling of database names in SQLdiag for long names and names that contain Unicode characters. |
SQLDiag | Windows | |
| 5649559 | Fixes an information disclosure issue in queued replication command decoding. | SQL Server Engine | Replication | Windows |
| 5649819 | Improves validation of column ordinals in replication rowsets. | SQL Server Engine | Replication | Windows |
| 5653507 | Strengthens security validation for replication during database upgrades. | SQL Server Engine | Windows | |
| 5653532 | Improves the validation of conflict table names for transactional replication. | SQL Server Engine | Replication | Windows |
| 5653543 | Improves the handling of column names in merge replication stored procedures. | SQL Server Engine | Replication | Windows |
| 5653585 | Improves identifier validation for transactional replication. | SQL Server Engine | Replication | Windows |
| 5653601 | Improves the handling of conflict table names in merge replication. | SQL Server Engine | Replication | Windows |
| 5653634 | Strengthens security validation for conflict reporting in merge replication. | SQL Server Engine | Replication | Windows |
| 5653702 | Improves the validation of object names for schema changes in merge replication. | SQL Server Engine | Replication | Windows |
| 5653714 | Improves the handling of table names in the generated procedures for merge replication. | SQL Server Engine | Replication | Windows |
| 5653730 | Strengthens input validation for change processing in merge replication. | SQL Server Engine | Replication | Windows |
| 5653751 | Improves security if transactional replication processes schema changes. | SQL Server Engine | Replication | Windows |
| 5653783 | Strengthens security checks for lightweight merge replication operations. | SQL Server Engine | Replication | Windows |
| 5653815 | Improves security validation for the processing of queued replication data. | SQL Server Engine | Replication | Windows |
| 5654543 | Improves the protection of replication data and operations. | SQL Server Engine | Replication | |
| 5657031 | Disables XSLT scripting by default. To restore previous behavior, set EnableXsltScript to 1 under HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\{version}\SSIS\XMLTask. |
Windows | ||
| 5657354 | Fixes a heap over-read action that occurs if the SQL task in SQL Server Integration Services processes OLE DB output parameters. | Integration Services | Integration Services | Windows |
| 5658051 | Fixes an integer overflow that can cause memory access issues in the HTTP connection manager of SQL Server Integration Services. | Integration Services | Integration Services | Windows |
| 5658157 | Fixes a memory access violation that might occur when you use the Raw File source component of SQL Server Integration Services. | Integration Services | Integration Services | Windows |
| 5699972 | Rolls back the changes that were introduced by the queued replication hotfix. | Replication | Windows | |
| 5699973 | Rolls back the changes that were introduced by the queued replication hotfix. | SQL Server Engine | Replication | Windows |
| 5723085 | Fixes replication queue parameter validation to reject boundary strings that exceed the WCHAR conversion buffer. | SQL Server Engine | Windows | |
| 5723096 | Fixes replication queue parameter validation to reject boundary strings that exceed the WCHAR conversion buffer. | SQL Server Engine | Replication | Windows |
| 5723124 | Fixes an information disclosure vulnerability in replication queue command decoding. | SQL Server Engine | Replication | Windows |
| 5723135 | Improves Merge Replication error-source parsing by adding bounded validation. | SQL Server Engine | Replication | Windows |
| 5723272 | Fixes a heap buffer overflow that can occur in the Log Reader Agent. | SQL Server Engine | Replication | Windows |
| 5725150 | Strengthens security checks for linked server access in replication. | SQL Server Engine | Replication | Linux, Windows |
| 5731767 | Fixes an elevation of privilege vulnerability in SQL Server merge replication. Replication system procedures now reject batch separators in subscriber validation expressions. | SQL Server Engine | Replication | Windows |
How to obtain and install the update
Method 1: Windows Update
This update is available through Windows Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to turn on automatic updating, see Windows Update: FAQ.
Method 2: Microsoft Update Catalog
To get the standalone package for this update, go to the Microsoft Update Catalog website.
Note
- The detection logic has been updated for this and future security releases that are posted to the Microsoft Update Catalog website. For more information, see Updates to the Microsoft Update detection logic for SQL Server servicing.
- This update is made available through the Microsoft Update Catalog for all servers that are running SQL Server, even if Reporting Services is not installed. Installing this security update is optional for computers that do not host Microsoft SQL Server Reporting Services.
Method 3: Microsoft Download Center
The following file is available for download from the Microsoft Download Center:
More information
Prerequisites
To apply this update, you must have SQL Server 2017 or any SQL Server 2017 GDR release through this SQL Server 2017 GDR installed.
Security update deployment information
For deployment information about this update, see Deployments - Security Update Guide.
File hash information
| File name | SHA256 hash |
|---|---|
| SQLServer2017-KB5132749-x64.exe | D5583711DC58E747BD96C521635747D0C59D1255DE94B355A545A472DC541329 |
File information
The English version of this package has the file attributes (or later file attributes) that are listed in the following worksheet. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it's converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.
For all supported x64-based versions - Download the list of files that are included in security update 5132749.
Information about protection and security
Protect yourself online: Windows Security support
Learn how we guard against cyber threats: Microsoft Security