KB5126967 - Description of the security update for SQL Server 2025 CU9: October 13, 2026

Applies To

SQL Server 2025 on Windows (all editions), SQL Server 2025 on Linux (all editions)

Release date: October 13, 2026

Version: 17.0.5015.4

Summary

This security update contains fixes and resolves vulnerabilities. To learn more about the vulnerabilities, see the following security advisories:

The Microsoft SQL Server components are updated to the following builds in this security update:

  • SQL Server - product version: 17.0.5015.4, file version: 2025.170.5015.4

Important

To help secure SQL Server on Windows, enable encryption with Extended Protection.

Known issues in this update

Linked server queries that use MSDASQL fail with error 7416

Linked server queries that use the MSDASQL (OLE DB Provider for ODBC Drivers) provider and specify a provider string (@provstr) fail and return the following error message:

Msg 7416, Level 16
Access to the remote server is denied because no login-mapping exists.

A stricter connection validation check in the Database Engine can reject connections for certain linked server configurations that use the MSDASQL provider, even if earlier builds allowed those connections.

For more information and workarounds, see Linked server queries that use MSDASQL fail with error 7416.

Access violation when you query sys.dm_exec_requests during database recovery

Queries against sys.dm_exec_requests might raise an access violation and generate a dump file if they run while a database is still recovering. This issue can occur during a database RESTORE operation, during startup recovery, or before an availability group replica finishes coming online.

The SQL Server error log contains entries that resemble the following text:

The database '<DatabaseName>' is marked RESTORING and is in a state that does not allow recovery to be run.
***Stack Dump being sent to <SQLServerLogFolder>\SQLDump0215.txt
SqlDumpExceptionHandler: Process 77 generated fatal exception c0000005 EXCEPTION_ACCESS_VIOLATION. SQL Server is terminating this process.
*******************************************************************************

BEGIN STACK DUMP:
  07/30/26 07:37:23 spid 77

Exception Address = <frame id="00" address="0x7FFDED94970D" pdb="sqlmin.pdb" age="2" guid="E1039014-237E-4DB6-88FD-4A2AB31C651F" module="sqlmin" rva="0x2970D" />
Exception Code    = c0000005 EXCEPTION_ACCESS_VIOLATION
Access Violation occurred reading address 00000000000000F0
Input Buffer <size> bytes -
          <dbo.sp_YourMonitoringStoredProcedure>

This issue occurs because of a change that causes internal in-memory structures to be referenced before they're fully initialized.

Microsoft is aware of this issue and is investigating a fix. Until a fix is available, use one of the following mitigations:

  • Enable trace flag 4696 to opt out of the code change that causes this issue. If you enable this trace flag, monitoring queries that query sys.dm_exec_requests or sys.sysprocesses on secondary replicas might return error 976 or error 978, as they did before you installed this update.
  • Avoid queries against sys.dm_exec_requests for databases that are recovering.
  • Uninstall this update.

Improvements and fixes included in this update

A downloadable Excel workbook that contains a summary list of builds, together with their current support lifecycle, is available. The Excel file also contains detailed fix lists. Download this Excel file now.

Note

Individual entries in the following table can be referenced directly through a bookmark. If you select any bug reference ID in the table, a bookmark tag is added to the URL by using the "#bkmk_NNNNNNN" format. You can then share this URL with others so that they can jump directly to the desired fix in the table.

Bug reference Description Fix area Component Platform
5494270 Addresses an input-validation issue in SQL Server Virtual Device Interface (VDI) and SQL Writer backup paths in which malformed size values potentially cause out-of-bounds memory access. Introduces hardened arithmetic and transfer-sized validation to reject invalid requests before unsafe memory handling occurs. SQL Server Engine Backup Restore Windows
5544846 Addresses an integer handling issue in SQL Server backup and restore metadata processing that potentially allows a local authenticated user to gain elevated privileges and cause a service to stop responding. Adds strict bounds validation and safe size calculation checks to reject malformed or oversized inputs before memory operations occur. SQL Server Engine Backup Restore Windows
5563245 Adds validation of FILESTREAM fragment size on Availability Group secondary replicas to reject oversized fragments. SQL Server Engine High Availability and Disaster Recovery Linux, Windows
5570179 Addresses an issue that causes the SQL Server process to terminate unexpectedly while working with external data sources. SQL Server Engine PolyBase Linux, Windows
5571548 Fixes a security vulnerability in the SQL Server Virtual Device Interface (VDI) in which an out-of-bounds write action potentially occurs while opening a virtual device set. SQL Server Engine Backup Restore Linux, Windows
5571951 Fixes a security vulnerability in the SQL Server Virtual Device Interface (VDI) in which an out-of-bounds read or write action potentially occurs while processing transferred data during backup or restore operations. SQL Server Engine Backup Restore Linux, Windows
5574694 Resolves a security vulnerability in PolyBase by improving validation during data processing. SQL Server Engine PolyBase Linux, Windows
5575377 Fixes unsafe deserialization of PolyBase rollback queue data so that malformed payloads are rejected. SQL Server Engine PolyBase Linux, Windows
5578133 Addresses an input-validation issue in SQL Server Virtual Device Interface (VDI) and SQL Writer backup paths in which malformed size values potentially cause out-of-bounds memory access. Introduces hardened arithmetic and transfer-sized validation to reject invalid requests before unsafe memory handling occurs. SQL Server Engine Backup Restore Windows
5578372 Addresses an integer handling issue in SQL Server backup and restore metadata processing that potentially allows a local authenticated user to gain elevated privileges and cause a service to stop responding. Adds strict bounds validation and safe size calculation checks to reject malformed or oversized inputs before memory operations occur. SQL Server Engine Backup Restore Windows
5578949 Fixes multiple memory-corruption and memory-disclosure vulnerabilities in SQL Server's SQL Satellite protocol message parsing logic that's used by Machine Learning Services and Language Extensions. SQL Server Engine Extensibility Linux, Windows
5579286 Adds validation for delta table schema. SQL Server Engine PolyBase Linux, Windows
5579344 Fixes invalid memory-read vulnerability in SQL Server's AI_GENERATE_EMBEDDINGS runtime parameter processing. SQL Server Engine Extensibility Linux, Windows
5579729 Updates shared memory handling. SQL Server Engine PolyBase Linux, Windows
5582300 Fixes an issue in which MSDASQL-linked server connections fail if the provider string does not include a user ID (UID). SQL Server Engine Distributed Query Linux, Windows
5601560 Updates the third-party archive-extraction component that SQL Server uses if external language and external library packages are installed. After the update is applied, package extraction uses the refreshed component. SQL Server Engine Extensibility Linux, Windows
5632691 Improves security and reliability in replication security metadata handling during Subscriber database restore and upgrade. SQL Server Engine Replication Windows
5632804 Improves security and reliability for the Log Reader Agent in a heterogeneous transactional replication scenario. SQL Server Engine Replication Windows
5632817 Improves security and reliability for the change feed configuration. SQL Server Engine Replication Windows
5632852 Fixes a buffer overflow that occurs if merge replication processes more than 250 WebSync XML nickname entries. SQL Server Engine Replication Linux, Windows
5632878 Fixes an issue in replication operations that affects data validation. SQL Server Engine Replication Linux, Windows
5632891 Fixes an issue in merge replication Web Synchronization operations that affects data validation. SQL Server Engine Replication Linux, Windows
5632904 Fixes an issue in input data processing for change event streaming. SQL Server Engine Replication Linux, Windows
5632931 Strengthens authorization checks for certain replication-related database operations to prevent unintended disclosure of database information. SQL Server Engine Replication Linux, Windows
5635966 Limits LoginSid processing within the SQL Trace reader to the internal buffer size to prevent malformed trace data from causing an out-of-bounds read action. SQL Server Engine Programmability Linux, Windows

How to obtain and install the update

Method 1: Windows Update

This update is available through Windows Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to turn on automatic updating, see Windows Update: FAQ.

Method 2: Microsoft Update Catalog

To get the standalone package for this update, go to the Microsoft Update Catalog website.

Note

  • The detection logic has been updated for this and future security releases that are posted to the Microsoft Update Catalog website. For more information, see Updates to the Microsoft Update detection logic for SQL Server servicing.
  • This update is made available through the Microsoft Update Catalog for all servers that are running SQL Server, even if Power BI Report Server is not installed. Installing this security update is optional for computers that do not host Power BI Report Server. For more information, see Download Power BI Report Server.

Method 3: Microsoft Download Center

The following file is available for download from the Microsoft Download Center:

Download icon Download the package now

How to obtain or download the latest cumulative update package for Linux

To update SQL Server 2025 on Linux to the latest CU, you must first have the Cumulative Update repository configured. Then, update your SQL Server packages by using the appropriate platform-specific update command.

For installation instructions and direct links to the CU package downloads, see the SQL Server 2025 Release Notes.

More information

Prerequisites

To apply this update, you must have SQL Server 2025 or any SQL Server 2025 CU release through this SQL Server 2025 CU9 GDR installed.

Security update deployment information

For deployment information about this update, see Deployments - Security Update Guide.

File hash information

File name SHA256 hash
SQLServer2025-KB5126967-x64.exe 709AFE429AE38A64AFC0709356FDE160837EB07F2D1DD447AC40733CBC7408AF

File information

The English version of this package has the file attributes (or later file attributes) that are listed in the following worksheet. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it's converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

For all supported x64-based versions - Download the list of files that are included in security update 5126967.

Information about protection and security

Protect yourself online: Windows Security support

Learn how we guard against cyber threats: Microsoft Security