KB5122772: Security update for SQL Server 2019, CU branch, September 2026. 52 vulnerabilities addressed; linked-server queries can fail

For: SQL Server administrators on Linux and Windows

• PolyBase handles unsafe data more safely.¹
  Addresses unsafe deserialization in the SQL Server PolyBase Engine.
• PolyBase services no longer open certain direct network connections when started with modified command-line settings.¹⁹
  Prevents PolyBase services from opening raw TCP listeners for the DW Engine and DMS control and data channels when modified command-line parameters activate the deprecated feature.

• Managed backup procedures get a security fix.²
  Addresses a vulnerability affecting managed_backup.sp_get_encryption_option and managed_backup.sp_do_backup; customers using managed backup should apply the update through standard SQL Server servicing.
• Invalid or incomplete backup details are rejected safely.³
  Improves internal validation of backup metadata processed by the SQL Server Volume Shadow Copy Service (VSS) Writer.

• SQL Server Agent applies stronger checks when loading task components.⁴
  Strengthens security validation when SQL Server Agent loads task-agent components.
• SQL Server Agent handles certain inputs more reliably and securely.⁵
  Addresses reliability and security issues when SQL Server Agent processes specific input.
• SQL Server Agent gets security and reliability fixes for certain operating conditions.¹⁵
  Addresses an issue affecting SQL Server Agent security and reliability under specific operating conditions.

For: SQL Server administrators on Windows

• The SQL WMI Provider handles malformed input correctly while retaining its behavior for valid input.⁶
  Fixes incorrect processing of malformed input by the SQL WMI Provider.

For: SQL Server administrators on Linux and Windows

• SQL Server's Microsoft Entra sign-in handling gets a security fix.⁷
  Addresses a security vulnerability in Microsoft Entra authentication login handling.

For: SQL Server administrators on Windows

• SQL Server handles malformed network data with invalid length values more safely.⁸
  Addresses validation of malformed Tabular Data Stream (TDS) and Binary XML input processed by SQL Server components.

• Replication procedures handle supplied and stored identifiers correctly.⁹
  Addresses identifier handling and input validation in replication stored procedures.
• Replication procedures handle longer or unusual identifiers correctly.¹⁰
  Fixes replication stored procedures that incorrectly process identifiers containing longer or special characters.
• Replication procedures handle identifiers with special characters correctly.¹¹
  Fixes replication stored procedures that incorrectly process identifiers containing special characters.
• A merge replication procedure checks supplied information more reliably.¹²
  Improves input validation for a merge replication metadata stored procedure.
• A replication procedure handles a supplied path correctly.¹³
  Addresses a replication stored procedure that handles a caller-supplied path value.
• Replication procedures check supplied values more reliably.¹⁴
  Improves input validation for parameters used by replication stored procedures.
• A replication lookup no longer reads arbitrary memory.²⁷
  Addresses an issue in which the class ID lookup call reads arbitrary memory.
• Replication checks the limits of embedded attestation information.²⁸
  Adds bounds validation for embedded attestation fields.
• Replication handles malformed or malicious stored data more safely.²⁹
  Strengthens Object Store Format (OSF) deserialization against malformed or malicious stream data.
• Replication checks data lengths inside protected code more reliably.³⁰
  Strengthens buffer length validation checks within enclave code.
• A replication lookup no longer reads arbitrary memory.³²
  Addresses an issue in which the class ID lookup call reads arbitrary memory.
• Replication better protects internal data while processing it.³⁴
  Addresses an issue affecting the protection of internal replication data during processing operations.
• Merge Replication handles text data correctly during processing.³⁵
  Addresses an issue in Merge Replication affecting the handling of text data during processing operations.
• Replication gets stronger checks for safer and more reliable processing.³⁶
  Addresses an issue in replication operations affecting validation and handling to enhance security and reliability.

For: SQL Server administrators on Linux and Windows

• A text-processing function no longer reads past its allocated memory when handling certain malformed text in a compiled database procedure.¹⁶
  Addresses SUBSTRING reading beyond the allocated buffer while processing malformed double-byte character set (DBCS) varchar input in a natively compiled In-Memory OLTP procedure.
• Converting or shortening certain text in a compiled database procedure no longer causes the server to stop responding.¹⁷
  Addresses an access violation when converting or truncating an NVARCHAR value containing an Ideographic Variation Sequence (IVS) under a Variation Selector Sensitive (_VSS) collation in a natively compiled In-Memory OLTP procedure.
• Streaming large text from a compiled procedure no longer overwrites memory in certain conditions that could stop the server.¹⁸
  Fixes a heap buffer overwrite when a natively compiled stored procedure streams nvarchar(max) data with SET TEXTSIZE truncation under a Variation Selector Sensitive (_VSS) collation and uses small TDS packet sizes.

For: SQL Server administrators on Linux and Windows

• A query with an extremely large plan description no longer causes SQL Server to stop unexpectedly.²⁰
  Addresses an access violation when processing a query with an extremely large OPTION (USE PLAN) XML declaration.
• SQL Server handles a type of XML attribute list correctly.²³
  Addresses an XML data type handling bug in Document Type Definition (DTD) attribute lists.
• A specially crafted XML file no longer causes SQL Server to stop responding or terminate unexpectedly when imported.²⁴
  Fixes an integer overflow in the SQL Server XML reader when processing a specially crafted XML format file through OPENROWSET(BULK...) or BULK INSERT.

• SQL Server processes and displays certain internal event information more securely.²¹
  Updates how SQL Server processes and outputs certain internal event data to help protect information.
• A data-writing method gets a fix for a memory-write issue that could affect availability or security when the common language runtime is enabled.³³
  Addresses improper field offset validation in SqlDataRecord.SetBytes for sql_variant values; prevents an out-of-bounds heap write that could cause denial of service or elevation of privilege when CLR is enabled.

For: SQL Server administrators on Linux and Windows

• Extended Events gets a security fix for a problem that could damage memory.²²
  Addresses insufficient validation in Extended Events that can cause memory corruption.
• Reading a specially crafted event file no longer exposes information or causes a denial of service.²⁵
  Resolves several security vulnerabilities triggered when the database engine reads a specially crafted Extended Events (.xel) file.

For: SQL Server administrators on Linux and Windows

• An authenticated user can no longer use invalid input to disclose a limited amount of memory.²⁶
  Strengthens input validation to address improper validation that could allow an authenticated user to disclose a limited amount of memory.
• Invalid input from an authenticated user can no longer trigger memory-read problems that might create a dump file or cause low-memory conditions.³¹
  Strengthens input validation for an issue where SQL Server dereferences and reads, but does not execute, a pointer provided by an authenticated user.

• Replication procedures get stronger internal checks.³⁷
  Improves validation and security checks for replication stored procedures so operations use the expected safeguards.
• Queued Updating Subscriptions in Transactional Replication get security and reliability improvements.³⁸
  Includes security and reliability improvements for Queued Updating Subscriptions in Transactional Replication.
• Queued Updating Subscriptions in Transactional Replication get security and reliability improvements.³⁹
  Includes security and reliability improvements for Queued Updating Subscriptions in Transactional Replication.

For: SQL Server administrators on Windows

• Showplan handles input more securely and reliably.⁴⁰
  Improves the handling of input to Showplan to enhance security and reliability.