Skip to the content
The Update Bureau
SQL Server 2025 CU5 SQL Server 2025 CU5 Cumulative update

KB5084896

KB5084896: Cumulative update for SQL Server 2025, CU branch, May 2026. XXE and SQL injection flaws fixed; lock-memory control added

In short

Fixes seven issues, including an XXE vulnerability in the Web Service Task and a SQL injection vulnerability. It also adds a setting to limit lock-manager cache memory.

Does it affect you? Applies to: SQL Server 2025 installations on Windows and Linux. The update package also updates Analysis Services components when they are installed.

Build
17.0.4045.5
Servicing branch
CU
Restart
Required

For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?

What changes

Fixes 4 changes

Patching

For: Administrators installing SQL Server on older Windows versions

  • SQL Server setup no longer encounters an EntryPointNotFoundException for GetNumaNodeProcessorMask2 on older Windows versions.1

Integration Services

For: SQL Server Integration Services users on Windows

  • The Web Service Task blocks a file-access protocol in WSDL service endpoints to prevent unauthorized file access and denial-of-service attacks.2
    Fixes an XML External Entity (XXE) vulnerability by blocking the file:// protocol in WSDL service endpoints.

In-Memory OLTP

For: SQL Server users of in-memory OLTP

  • CPU starvation during in-memory OLTP garbage collection scans of hash indexes is addressed.3
    Adds yields at regular intervals during garbage collection scans of in-memory OLTP hash indexes.

SQL System CLR Types

  • SQL injection through the spatial geography and geometry index helper procedures is fixed.4
    Fixes a SQL injection vulnerability involving sp_help_spatial_geography_index and sp_help_spatial_geometry_index.

New features 2 changes

Memory Management

  • A new setting lets administrators control the maximum size of the lock-manager cache.5
    Adds the max lock manager cache memory (%) configuration setting.

Replication

For: SQL Server administrators on Linux

  • Linux installations can configure change feed parameters through mssql.conf.6

Improvement 1 change

Search

For: SQL Server users of full-text indexing

  • Full-text indexing can use the version 2 feature. Indexing .docx files also returns correct results when a paragraph begins in a hyperlink and the preceding paragraph has no trailing whitespace.7
    Enables FulltextIndexVersion2 by setting the database-scoped configuration fulltext_index_version to 2; fixes the described .docx full-text indexing issue.

Known issues

  1. Open Affects: Organizations and IT administrators

    Linked server queries that use MSDASQL fail with error 7416

    Linked server queries using the MSDASQL provider and a provider string can fail with error 7416, reporting that no login mapping exists.8

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  2. Open Affects: Organizations and IT administrators

    Incorrect behavior of SESSION_CONTEXT in parallel plans

    Queries using SESSION_CONTEXT might return incorrect results or create access violation dump files when they run in parallel query plans, particularly when a session is reset for reuse.9

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-05-20
Classification
Updates
Type
Cumulative update
Servicing branch
CU
Restart
Required
Replaces
KB5081495, KB5077896, KB5075211, KB5078298
Replaced by
KB5093421
VersionBuildChannel
2025 17.0.4045.5 General availability

Security

No vulnerabilities are listed for this update.

Downloads (Microsoft Update Catalog)

Package 2025
407.2 MB
sqlserver2025-kb5084896-x64.exe Main update · KB5084896 SHA-1: 9f07a18f…b7acde

Updated components

196 files changed since the previous update for the same versions.

Top changed componentsFiles
SQL Server Engine30
SQL Server Integration Services21
SQL Server Replication12
SQL Server Agent4
SQL Server Machine Learning Services4
SQL Server Full-Text Search2
SQL Server PolyBase2

Sources

Updated
Cited passages from Microsoft's official notes (9)
  1. 1. Fixes an issue in which an EntryPointNotFoundException for GetNumaNodeProcessorMask2 occurs during SQL Server setup on older Windows OS versions. learn.microsoft.com
  2. 2. Fixes an XML External Entity (XXE) vulnerability in the Web Service Task by blocking the file:// protocol in WSDL service endpoints to prevent unauthorized file access and denial-of-service attacks. learn.microsoft.com
  3. 3. Fixes CPU starvation issues by adding yields at regular intervals during in-memory OLTP garbage collection scan of hash indexes. learn.microsoft.com
  4. 4. Fixes a vulnerability that allows SQL injection through the sp_help_spatial_geography_indexand sp_help_spatial_geometry_index stored procedures. learn.microsoft.com
  5. 5. Adds a new max lock manager cache memory (%) configuration setting to control the maximum size of lock manager cache memory. learn.microsoft.com
  6. 6. Adds support for configuring change feed parameters by using mssql.conf. learn.microsoft.com
  7. 7. Allows the FulltextIndexVersion2 feature to be enabled by setting the database-scoped configuration fulltext_index_version to 2. Also fixes an issue in which full-text indexing of .docx files produces incorrect results when paragraphs begin in hyperlinks without trailing whitespace in the preceding paragraph. learn.microsoft.com
  8. 8. Linked server queries that use the MSDASQL (OLE DB Provider for ODBC Drivers) provider and specify a provider string (@provstr) fail and return the following error message: learn.microsoft.com
  9. 9. Queries that use the built-in SESSION_CONTEXT function might return incorrect results or trigger access violation (AV) dump files when run in parallel query plans. learn.microsoft.com
Checked automatically: 8 of 8 checks passed, 9 quoted passages · compared with Microsoft's page on Sep 26, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake