KB5058713: Security update for SQL Server 2019, GDR branch, July 2025. Query and memory flaws fixed; Setup restart issue addressed

The update fixes three SQL Server vulnerabilities and addresses a Setup problem that could cause restarts and prevent installation from continuing.

Does it affect you? Applies to: Devices running SQL Server 2019 or a SQL Server 2019 GDR release through this update. The update is optional on computers that do not host SQL Server Reporting Services.

For servers on the GDR branch: they get security fixes only. Servers that install cumulative updates (CU branch) get a separate update. Which branch am I on?

What changes

Fixes 4 changes

Programmability

2 items

Under specific conditions, an attacker could run a query that makes the server unavailable; this issue is fixed.¹
SQL Server Engine fix, bug reference 4239001.
In rare cases, using limited-length parameters with the REPLACE function could return uninitialized memory; this issue is fixed.²
SQL Server Engine fix, bug reference 4239670.

Query Execution

In rare cases, uninitialized memory could be read when variable-length parameters were used; this issue is fixed.³
SQL Server Engine fix, bug reference 4053213.

Patching

For: SQL Server administrators on Windows

A problem introduced by a previous Windows update could cause restarts and prevent Setup from continuing; this update addresses it.⁴
When SQL Server updates are applied, the PendingFileRenameOperations registry value is deleted. SQL Setup fix, bug reference 4241788.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2025-07-08
Classification: Security Updates
Type: Cumulative update
Servicing branch: GDR
Restart: Required
Replaces: KB5046859, KB5046056, KB5042214, KB5040986, KB5035434
Replaced by: KB5063758

Version	Build	Channel
2019	15.0.2135.5	General availability

Security

3 vulnerabilities fixed

3 important

Vulnerability	Severity	CVSS
CVE-2025-49717 Microsoft SQL Server Remote Code Execution Vulnerability	Important	8.5
CVE-2025-49718 Microsoft SQL Server Information Disclosure Vulnerability	Important	7.5
CVE-2025-49719 Microsoft SQL Server Information Disclosure Vulnerability	Important	7.5

Downloads (Microsoft Update Catalog)

Package 2019

506.5 MB

sqlserver2019-kb5058713-x64.exe Main update · KB5058713 SHA-1: 2c9c0bc0…55b57d

Sources

Microsoft Support: KB5058713

Updated Oct 27, 2026

Cited passages from Microsoft's official notes (4)

1. Fixes an issue where under specific conditions an attacker can execute a query against the server to cause unavailability. support.microsoft.com
2. Fixes an issue in which uninitialized memory is returned in some rare cases when using limited length parameters with REPLACE function. support.microsoft.com
3. Fixes an issue in which uninitialized memory can be read in some rare cases when using variable length parameters. support.microsoft.com
4. Fixes an issue that was introduced in a previous Windows update that causes restarts and prevents Setup from continuing. After you apply this fix, the value of the PendingFileRenameOperations registry key is deleted when you apply updates to SQL Server. support.microsoft.com

Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake