KB5129223 - Cumulative Update 11 for SQL Server 2025

Release Date:   November 12, 2026
Version:   17.0.5065.9

Summary

This article describes Cumulative Update 11 (CU11) for Microsoft SQL Server 2025. This update package contains 70 fixes that were issued after the release of SQL Server 2025 Cumulative Update 10. It updates components in the following builds:

  • SQL Server - Product version: 17.0.5065.9, file version: 2025.170.5065.9
  • Analysis Services - Product version: 17.0.25.227, file version: 2025.170.25.227

Important

To help secure SQL Server on Windows, enable encryption with Extended Protection.

Known issues in this update

Incorrect behavior of SESSION_CONTEXT in parallel plans

Queries that use the built-in SESSION_CONTEXT function might return incorrect results or trigger access violation (AV) dump files when run in parallel query plans. This issue occurs because of the manner in which SESSION_CONTEXT interacts with parallel execution threads, particularly if the session is reset for reuse.

For more information, see the Known issues section in SESSION_CONTEXT.

Improvements and fixes included in this update

A downloadable Microsoft Excel workbook that contains a summary list of builds, together with their current support lifecycle, is available. The Excel file also contains detailed fix lists for SQL Server 2025, SQL Server 2022, SQL Server 2019, and SQL Server 2017. Download this Excel file now.

Note

Individual entries in the following table can be referenced directly through a bookmark. If you select any bug reference ID in the table, a bookmark tag is added to the URL by using the "#NNNNNNN" format. You can then share this URL with others so that they can jump directly to the desired fix in the table.

For more information about the bugs that are fixed and enhancements that are included in this cumulative update, see the following table.

Bug reference Description Fix area Component Platform
4708722 Fixes an issue in which a query that applies a string predicate over a window aggregate might return incorrect results if the partitioning column uses a case-insensitive collation. SQL Server Engine Query Optimizer All
5216512 Fixes an issue in which monitoring queries that use sys.dm_exec_requests or sys.sysprocesses intermittently fail and return a "976" or "978" error message when they run on a read-intent-only secondary replica in an availability group. SQL Server Engine High Availability and Disaster Recovery Windows
5299582 Adds support for certificate authentication of endpoints on systems where only Transport Layer Security (TLS) 1.3 is enabled. Startup trace flag 12389 disables this support. SQL Server Engine High Availability and Disaster Recovery Linux
5383175 Fixes error "33550", state "42", that occurs when a secure enclave in SQL Server decrypts empty or NULL values in varchar(max), nvarchar(max), or varbinary(max) columns that use Always Encrypted. SQL Server Engine Security Infrastructure Windows
5404183 Fixes an issue in which running sys.dm_exec_describe_first_result_set from a Service Broker-activated stored procedure causes an access violation and unexpectedly ends the connection. SQL Server Engine Programmability All
5478461 Fixes an issue in which an availability group listener that uses a Dynamic Host Configuration Protocol (DHCP) address doesn't come online. SQL Server Engine High Availability and Disaster Recovery Windows
5493283 Fixes an issue in which database performance counters are missing after you run DBCC CHECKDB. SQL Server Engine Access Methods All
5509895 Fixes an issue in which the hadr_log_block_decompression extended event reports the same value for the compressed and uncompressed log block sizes. SQL Server Engine SQL OS All
5556160 Disables Extensible Stylesheet Language Transformations (XSLT) scripting by default in the SQL Server Integration Services XML Task. To restore the previous behavior, set EnableXsltScript to 1 under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server{version}\SSIS\XMLTask. Integration Services Integration Services Windows
5583457 Fixes a memory access violation that might occur when the Raw File source component in SQL Server Integration Services reads data. Integration Services Integration Services Windows
5583467 Fixes an integer overflow in the Integration Services HTTP Connection Manager that can cause invalid memory access. Integration Services Integration Services Windows
5583481 Fixes an issue in which handling truncated OLE DB output parameters in the Integration Services Execute SQL Task can cause invalid memory access. Integration Services Integration Services Windows
5587854 Fixes an issue in which Multidimensional Expressions (MDX) queries that use nested subselects over ragged hierarchies configured with HideMemberIf omit hidden leaf members, resulting in missing rows or lower measure totals. Analysis Services Analysis Services Windows
5588864 Adds Transport Layer Security (TLS) support through Schannel for Service Broker endpoints. SQL Server Engine High Availability and Disaster Recovery All
5614197 Improves identifier validation in merge replication. SQL Server Engine Replication Windows
5616144 Fixes an issue in which Multidimensional Expressions (MDX) queries cause SQL Server Analysis Services to end unexpectedly when relational online analytical processing (ROLAP) mode and proactive caching are enabled. Analysis Services Analysis Services Windows
5619552 Adds support for the SQL_Japanese_180_EBCDIC930_CS_AS_UTF8 collation. Use the sys.sp_db_ebcdic930_collation stored procedure to turn on this collation for a database. SQL Server Engine Programmability All
5619731 Fixes an issue in which ALTER SYMMETRIC KEY that uses ADD ENCRYPTION BY ASYMMETRIC KEY fails when it uses an asymmetric key from an Extensible Key Management (EKM) provider on Linux. SQL Server Engine Security Infrastructure All
5622544 Improves output-buffer validation in XA stored procedures to prevent buffer overflows. Undersized output buffers now return error 47204. SQL Server Engine Transaction Services All
5622622 Improves identifier validation in transactional replication. SQL Server Engine Replication Windows
5623595 Fixes an access violation that can occur if JSON functions process a path that has more than 128 nesting levels. SQL Server now returns an error instead of crashing. SQL Server Engine Programmability All
5624076 Fixes an issue in which permissions are not cleaned up when an EXTERNAL MODEL is dropped. SQL Server Engine Extensibility All
5624101 Improves validation of transaction log blocks during recovery and log scanning to prevent out-of-bounds memory read actions when scanning malformed records. SQL Server Engine Storage Management Windows
5624540 Improves security by initializing buffers that are used during index record construction and B-tree page splits. SQL Server Engine Methods to access stored data Windows
5624553 Fixes an issue in which querying a corrupted row-compressed record can return unintended memory content. SQL Server now validates the compressed-record metadata and returns a database corruption error message. SQL Server Engine Methods to access stored data All
5624575 Improves security by initializing buffers that are used during storage engine insert, update, bulk, compression, and record reconstruction operations. SQL Server Engine Methods to access stored data Windows
5624585 Improves validation of long-column offsets in page-compressed records to reject malformed record metadata. SQL Server Engine Methods to access stored data Windows
5624878 Improves validation of sparse-column record headers and column offsets when SQL Server reads or rebuilds records. SQL Server Engine Methods to access stored data Windows
5624927 Improves validation of columnstore header sizes when SQL Server attaches, restores, or checks a database. SQL Server Engine Column Stores Windows
5624951 Improves validation of variable-length column offsets when SQL Server processes database records. SQL Server Engine Methods to access stored data Windows
5624994 Improves validation of column metadata to prevent out-of-bounds memory write actions when SQL Server loads database schemas. SQL Server Engine Methods to access stored data Windows
5625854 Fixes an issue in which online index or constraint changes that run concurrently with data modifications can cause assertion failures during change capture. SQL Server Engine Replication Windows
5632843 Fixes a security issue in authorization checks for merge replication row metadata. SQL Server Engine Replication All
5632869 Improves bounds validation when merge replication processes retry information. SQL Server Engine Replication All
5635196 Strengthens security validation for stored procedures that are used by merge replication. SQL Server Engine Replication Windows
5640558 Fixes non-yielding scheduler errors and dump files that can occur when querying sys.dm_db_index_operational_stats on databases that have a very large number of tables, indexes, or partitions. SQL Server Engine Access Methods All
5642393 Improves object name validation in internal stored procedures while preserving existing behavior. SQL Server Engine Management Services All
5645713 Improves SQLDiag handling of database names, including long names and Unicode characters, to enhance diagnostic collection reliability and security. SQL Server Client Tools SQLDiag Windows
5650754 Adds trace flag 683 to reduce CPU overhead when heap or B-tree (HoBt) latches are promoted to superlatches but counter partitioning does not occur. SQL Server Engine Methods to access stored data All
5653494 Improves security validation during replication database upgrades. SQL Server Engine Replication Windows
5653522 Improves conflict table name validation in transactional replication. SQL Server Engine Replication Windows
5653571 Improves parameter validation in the Replication Queue Reader Agent. SQL Server Engine Replication Windows
5653594 Improves conflict table name handling in merge replication. SQL Server Engine Replication Windows
5653627 Improves security validation for merge replication conflict reporting. SQL Server Engine Replication Windows
5653639 Improves object name validation for merge replication schema changes. SQL Server Engine Replication Windows
5653706 Improves table name handling in generated merge replication procedures. SQL Server Engine Replication Windows
5653719 Improves input validation when SQL Server processes merge replication changes. SQL Server Engine Replication Windows
5653742 Improves security when SQL Server processes schema changes in transactional replication. SQL Server Engine Replication Windows
5653760 Improves security checks for lightweight merge replication operations. SQL Server Engine Replication Windows
5653804 Improves security validation when SQL Server processes queued replication data. SQL Server Engine Replication Windows
5653821 Improves authorization validation for SQL Server Agent job steps. SQL Server Engine Management Services Windows
5653831 Improves role validation during replication subscription checks. SQL Server Engine Replication Windows
5654545 Improves security for replication data and operations. SQL Server Engine Replication All
5656545 Improves configuration of operating system resource limits for native SQL Server installations on Linux, including mssql-conf startup, without changing container launch behavior. SQL Server Engine Linux Linux
5657265
Fixes an error that occurs when an online index operation runs concurrently with data manipulation language (DML) operations in a database that has Change Data Capture (CDC) enabled.
 SQL Server Engine DB Management All
5660542 Improves bounds validation when the Replication Queue Reader Agent processes queued update messages. SQL Server Engine Replication Windows
5660604 Improves input validation in the sys.sp_polybase_show_objects stored procedure. SQL Server Engine PolyBase All
5661769 Fixes an input validation issue in SQL Server VSS Writer in which an oversized user instance name can disrupt backup and snapshot operations or cause an out-of-bounds memory write action. SQL Server Engine Backup Restore Windows
5673577 Adds three stored procedures for databases in multi-database link mode with Azure SQL Managed Instance: sys.sp_milink_reseed restarts seeding without removing and re-adding the database to the availability group, sys.sp_milink_repair repairs a broken link, and sys.sp_milink_check checks database health. SQL Server Engine High Availability and Disaster Recovery All
5674437 Fixes an issue in which creating Extended Events log files fails on Linux loop devices that use certain sector sizes. SQL Server Engine Linux Linux
5693318 Fixes an issue in which ALTER DATABASE CURRENT ADD FILE fails and returns a "42019" error message on Azure SQL Managed Instance General Purpose and Next-gen General Purpose service tiers. SQL Server Engine Programmability All
5698417 Improves replication metadata validation to enhance security and reliability. SQL Server Engine Replication All
5720058 Improves security checks for replication linked-server access. SQL Server Engine Replication All
5720085 Improves input validation in Azure Synapse Link for SQL. SQL Server Engine Replication Windows
5722312 Fixes an information disclosure vulnerability in the xp_decodequeuecmd replication queue command decoder. SQL Server Engine Replication Windows
5722893 Improves parameter validation and data conversion handling in the Replication Queue Reader Agent. SQL Server Engine Replication Windows
5723113 Fixes a heap buffer overflow that can occur when the Log Reader Agent escapes single quotation marks in column values. SQL Server Engine Replication Windows
5723141 Improves error-source validation in merge replication to address a security vulnerability. SQL Server Engine Replication Windows
5723153 Improves column-list input validation in sp_MStable_validation to handle a security vulnerability. SQL Server Engine Replication Windows
5731757 Fixes an elevation of privilege vulnerability in merge replication by improving validation of subscriber validation expressions. SQL Server Engine Replication Windows

How to obtain or download this CU or the latest CU package

How to obtain or download the latest cumulative update package for Windows (recommended)

The following update is available from the Microsoft Download Center:

Download the latest cumulative update package for SQL Server 2025 now

Note

  • Microsoft Download Center always offers the latest SQL Server 2025 CU release.
  • If the download page doesn't appear, contact Microsoft Customer Service and Support to obtain the cumulative update package.
How to obtain or download this cumulative update package for Windows from Microsoft Update Catalog

The following update is available from the Microsoft Update Catalog:

Note

  • Microsoft Update Catalog contains this SQL Server 2025 CU and previously released SQL Server 2025 CU releases.
  • This CU is also available through Windows Server Update Services (WSUS).
  • We recommend that you always install the latest cumulative update that's available.
How to obtain or download the latest cumulative update package for Linux

To update SQL Server 2025 on Linux to the latest CU, you must first have the Cumulative Update repository configured. Then, update your SQL Server packages by using the appropriate platform-specific update command.

For installation instructions and direct links to the CU package downloads, see the SQL Server 2025 Release Notes.

File information

File hash information

You can verify the download by computing the hash of the SQLServer2025-KB5129223-x64.exe file through the following command:

certutil -hashfile SQLServer2025-KB5129223-x64.exe SHA256

File name SHA256 hash
SQLServer2025-KB5129223-x64.exe 7BA23981F036D7E57ECB57EFC9C4C8F09CC53BC93D0949DEC057DF8C34EF9EB6
Cumulative Update package file information

Download the list of files that are included in KB5129223.

Notes for this update

Prerequisites

To apply this cumulative update package, you must be running SQL Server 2025.

Restart information

You might have to restart the computer after you apply this cumulative update package.

Registry information

To use one of the hotfixes in this package, you don't have to make any changes to the registry.

Important notices

This article also provides the following important information.

Analysis Services CU build version

Beginning in Microsoft SQL Server 2017, the Analysis Services build version number and SQL Server Database Engine build version number don't match. For more information, see Verify Analysis Services cumulative update build version.

Cumulative updates (CU)

  • Each new CU contains all the fixes that were included in the previous CU for the installed version of SQL Server.
  • SQL Server CUs are certified to the same levels as service packs, and should be installed at the same level of confidence.
  • We recommend ongoing, proactive installation of CUs as they become available according to these guidelines:
    • Historical data shows that a significant number of support cases involve an issue that was already addressed in a released CU.
    • CUs might contain added value over and above hotfixes, such as supportability, manageability, and reliability updates.
  • We recommend that you test SQL Server CUs before you deploy them to production environments.
Hybrid environment deployment

When you deploy an update to a hybrid environment (such as Always On, replication, cluster, and mirroring), we recommend that you refer to the following articles before you deploy the update:

Language support

SQL Server CUs are currently multilingual. Therefore, this CU package isn't specific to one language. It applies to all supported languages.

Components (features) updated

One CU package includes all available updates for all SQL Server 2025 components (features). However, the cumulative update package updates only those components that are currently installed on the SQL Server instance that you select to be serviced. If a SQL Server feature (for example, Analysis Services) is added to the instance after this CU is applied, you must reapply this CU to update the new feature to this CU.

Support for this update

If other issues occur, or if any troubleshooting is required, you might have to create a service request. The usual support costs will apply to additional support questions and to issues that don't qualify for this specific cumulative update package. For a complete list of Microsoft Customer Service and Support telephone numbers, or to create a separate service request, go to the Microsoft support website.

How to uninstall this update

How to uninstall this update on Windows
  1. In Control Panel, open the Programs and Features item, and then select View installed updates.
  2. Locate the entry that corresponds to this cumulative update package under SQL Server 2025.
  3. Press and hold (or right-click) the entry, and then select Uninstall.
How to uninstall this update on Linux

To uninstall this CU on Linux, you must roll back the package to the previous version. For more information about how to roll back the installation, see Rollback SQL Server.

References