The Update BureauKB5058721: Security update for SQL Server 2022, CU branch, July 2025. Memory exposure and query outages fixed; Setup restart blocker removed
A SQL Setup defect that caused restarts and prevented Setup from continuing is fixed. The update also fixes three SQL Server Engine issues and addresses three Important vulnerabilities, including a publicly disclosed information-disclosure flaw.
Does it affect you? Applies to: SQL Server 2022 systems with SQL Server 2022 or any SQL Server 2022 cumulative update through CU19 GDR installed. The update is available for servers running SQL Server; installing it is optional on computers that do not host SQL Server Reporting Services.
For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?
What changes
Fixes 4 changes
Programmability
For: All SQL Server platforms
-
Under specific conditions, an attacker can no longer use a query to make the server unavailable.1
Fixes an issue where an attacker can execute a query against the server to cause unavailability.
-
In rare cases, using limited-length parameters with
REPLACEno longer returns uninitialized memory.2Fixes the return of uninitialized memory when using limited length parameters with theREPLACEfunction.
Query Execution
For: All SQL Server platforms
-
In rare cases, variable-length parameters no longer allow uninitialized memory to be read.3
Fixes the reading of uninitialized memory when using variable length parameters.
Patching
For: Windows-based SQL Server installations
-
A Setup problem that caused restarts and prevented Setup from continuing is fixed.4
When SQL Server updates are applied, the value of the
PendingFileRenameOperationsregistry key is deleted.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2025-07-08
- Classification
- Security Updates
- Type
- Cumulative update
- Servicing branch
- CU
- Restart
- Required
- Replaces
- KB5054531, KB5050771, KB5048038, KB5048033
- Replaced by
- KB5063814
| Version | Build | Channel |
|---|---|---|
| 2022 | 16.0.4200.1 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Microsoft SQL Server Remote Code Execution Vulnerability
|
Important | 8.5 |
|
Microsoft SQL Server Information Disclosure Vulnerability
|
Important | 7.5 |
|
Microsoft SQL Server Information Disclosure Vulnerability
|
Important | 7.5 |
Downloads (Microsoft Update Catalog)
Sources
Cited passages from Microsoft's official notes (4)
-
1.
Fixes an issue where under specific conditions an attacker can execute a query against the server to cause unavailability.
support.microsoft.com -
2.
Fixes an issue in which uninitialized memory is returned in some rare cases when using limited length parameters with REPLACE function.
support.microsoft.com -
3.
Fixes an issue in which uninitialized memory can be read in some rare cases when using variable length parameters.
support.microsoft.com -
4.
Fixes an issue that was introduced in a previous Windows update that causes restarts and prevents Setup from continuing.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake