Skip to the content
The Update Bureau
SQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update
Patch Tuesday

KB5058722

KB5058722: Security update for SQL Server 2019, CU branch, July 2025. Information disclosure flaw and Setup restart issue addressed

In short

The update addresses three important vulnerabilities, including publicly disclosed CVE-2025-49719, and fixes SQL Setup restarts that could prevent setup from continuing.

Does it affect you? Applies to: SQL Server 2019 instances with SQL Server 2019 or a CU through CU32 GDR installed. The update package is for x64. Installation is optional on computers that do not host SQL Server Reporting Services.

Build
15.0.4435.7
Servicing branch
CU
Security
3 fixed
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • This page The update addresses CVE-2025-49717, a SQL Server Remote Code Execution vulnerability, and CVE-2025-49718, an Information Disclosure vulnerability, as well as CVE-2025-49719, another Information Disclosure vulnerability.

The official sources are linked at the end of the page.

For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?

What changes

Fixes 5 changes

Programmability

2 items
  • Under specific conditions, an attacker can no longer execute a query against the server to cause it to become unavailable.1
    SQL Server Engine fix, bug reference 4238993.
  • In rare cases, uninitialized memory is no longer returned when the REPLACE function uses limited-length parameters.2
    SQL Server Engine fix, bug reference 4239681.

Query Execution

  • In rare cases, uninitialized memory can no longer be read when variable-length parameters are used.3
    SQL Server Engine fix, bug reference 4053221.

Replication

  • Manual change tracking cleanup no longer sets the invalid cleanup version to a negative value when the TableName parameter is omitted.4
    Fixes the manual change tracking cleanup stored procedure, bug reference 3801161.

Patching

  • A previous Windows update could cause restarts and prevent SQL Setup from continuing. This update deletes the PendingFileRenameOperations registry key value when you apply SQL Server updates.5
    SQL Setup fix for Windows, bug reference 4241789.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-07-08
Classification
Security Updates
Type
Cumulative update
Servicing branch
CU
Restart
Required
Replaces
KB5054833, KB5049296, KB5049235, KB5046860
+9 earlier KB5046365, KB5046060, KB5042749, KB5039747, KB5040948, KB5037331, KB5035123, KB5036335, KB5033688
Replaced by
KB5063757
VersionBuildChannel
2019 15.0.4435.7 General availability

Security

3 vulnerabilities fixed
3 important
VulnerabilitySeverityCVSS
CVE-2025-49717
Microsoft SQL Server Remote Code Execution Vulnerability
 Important 8.5
CVE-2025-49718
Microsoft SQL Server Information Disclosure Vulnerability
 Important 7.5
CVE-2025-49719
Microsoft SQL Server Information Disclosure Vulnerability
 Important 7.5

Downloads (Microsoft Update Catalog)

Package 2019
887.5 MB
sqlserver2019-kb5058722-x64.exe Main update · KB5058722 SHA-1: c3c44e8a…029882

Sources

Updated
Cited passages from Microsoft's official notes (5)
  1. 1. Fixes an issue where under specific conditions an attacker can execute a query against the server to cause unavailability. support.microsoft.com
  2. 2. Fixes an issue in which uninitialized memory is returned in some rare cases when using limited length parameters support.microsoft.com
  3. 3. Fixes an issue in which uninitialized memory can be read in some rare cases when using variable length parameters. support.microsoft.com
  4. 4. Fixes an issue in which the manual change tracking cleanup stored procedure incorrectly sets the invalid cleanup version to negative when the TableName parameter isn't passed. support.microsoft.com
  5. 5. Fixes an issue that was introduced in a previous Windows update that causes restarts and prevents Setup from continuing. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 5 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake