Skip to the content
The Update Bureau
SQL Server 2019 GDR SQL Server 2019 GDR Security update
Patch Tuesday

KB5122773

KB5122773: Security update for SQL Server 2019, GDR branch, September 2026. Three critical remote-code flaws affect the database engine

In short

Fixes 52 vulnerabilities, including three critical flaws that could allow remote code execution in SQL Server. It also lists an open issue that can make some linked server queries fail with error 7416.

Does it affect you? Applies to: SQL Server 2019 installations on the GDR branch. The package is for supported x64-based versions.

Build
15.0.2190.7
Servicing branch
GDR
Security
52 fixed · 3 critical
Restart
Required

For servers on the GDR branch: they get security fixes only. Servers that install cumulative updates (CU branch) get a separate update. Which branch am I on?

What changes

Fixes 33 changes

PolyBase

Verified in package 3 items
  • Unsafe deserialization in PolyBase Engine is addressed.1
    The table lists the fix under SQL Server Engine; the component is PolyBase.
  • PolyBase services no longer open raw TCP listeners for the DW Engine and DMS control and data channels when started with modified command-line parameters.3
    Addresses a remote code execution vulnerability involving modified PolyBase service command-line parameters that activate a deprecated feature.
  • PolyBase services no longer open raw TCP listeners for the DW Engine and DMS control and data channels when started with modified command-line parameters.20
    Addresses a remote code execution vulnerability involving modified PolyBase service command-line parameters that activate a deprecated feature.

Backup Restore

2 items
  • A vulnerability in the managed backup procedures is addressed.2
    Applies to managed_backup.sp_get_encryption_option and managed_backup.sp_do_backup. Customers using managed backup should apply the update through the standard SQL Server servicing process.
  • Malformed or undersized backup metadata is rejected more safely.4
    Improves internal validation of backup metadata processed by the SQL Server Volume Shadow Copy Service (VSS) Writer.

SQL Agent

3 items
  • Security validation is strengthened when SQL Server Agent loads task-agent components.5
  • Reliability and security issues are addressed when SQL Server Agent processes specific input.6
  • An issue affecting SQL Server Agent security and reliability under specific operating conditions is addressed.16

WMI Management Provider (SqlMgmProvider)

  • The SQL WMI Provider handles malformed input correctly while preserving existing behavior for valid input.7

Security Infrastructure

  • A security vulnerability in Microsoft Entra authentication login handling is addressed.8

SQL Connectivity

  • Malformed TDS and Binary XML input with invalid length values is handled more safely.9
    Addresses validation of malformed Tabular Data Stream (TDS) and Binary XML input processed by SQL Server components.

Replication

10 items

For: SQL Server administrators using replication

  • Replication stored procedures handle supplied and stored identifiers correctly.10
    Addresses identifier handling and input validation.
  • Replication stored procedures handle identifiers with longer or special characters correctly.11
  • Replication stored procedures handle identifiers with special characters correctly.12
  • A merge replication metadata procedure validates supplied values.13
    Improves reliability of input validation for a merge replication metadata stored procedure.
  • A replication stored procedure addresses an issue with caller-supplied path values.14
  • Replication stored procedure parameters receive improved input validation.15
    The validation helps ensure supplied values are processed reliably.
  • An issue where the class ID lookup call reads arbitrary memory is addressed.29
  • An issue affecting protection of internal replication data during processing is addressed.31
  • An issue affecting how Merge Replication handles text data during processing is addressed.32
  • Validation and handling in replication operations are addressed to improve security and reliability.33

In-Memory OLTP

3 items

For: SQL Server administrators using In-Memory OLTP

  • A natively compiled procedure no longer reads beyond its allocated buffer when the SUBSTRING function processes malformed DBCS varchar input.17
    The issue involves double-byte character set (DBCS) varchar input in a natively compiled In-Memory OLTP procedure.
  • Converting or truncating certain NVARCHAR values no longer causes an access violation that can make the server stop responding.18
    Applies to an Ideographic Variation Sequence (IVS) under a Variation Selector Sensitive (_VSS) collation in a natively compiled In-Memory OLTP procedure.
  • A natively compiled procedure no longer causes a heap buffer overwrite when streaming truncated nvarchar(max) data under the specified conditions.19
    The issue occurs with SET TEXTSIZE truncation under a Variation Selector Sensitive (_VSS) collation and can stop the server responding when the procedure uses small TDS packet sizes.

XML

3 items
  • A query with an extremely large OPTION (USE PLAN) XML declaration no longer causes an access violation that can terminate SQL Server unexpectedly.21
  • A bug in handling XML data type DTD attribute lists is addressed.24
    DTD means Document Type Definition.
  • A specially crafted XML format file no longer causes an integer overflow that can make SQL Server stop responding or terminate unexpectedly.25
    The issue can occur when SQL Server processes the file through OPENROWSET(BULK...) or BULK INSERT.

Programmability

2 items
  • SQL Server processes and outputs certain internal event data in a way that helps protect information.22
    Addresses a security issue in internal event data processing and output.
  • A field offset validation issue in SqlDataRecord.SetBytes is addressed to prevent an out-of-bounds heap write.30
    The issue could cause denial of service or elevation of privilege in SQL Server installations and Azure SQL Managed Instances with common language runtime (CLR) enabled.

Extended Events

2 items
  • Validation in Extended Events is strengthened to address a security issue that could cause memory corruption.23
  • Several vulnerabilities that could expose information or cause a denial of service when the database engine reads a specially crafted Extended Events file are resolved.26
    The file type is .xel.

Query Execution

2 items
  • Input validation is strengthened to address an issue that could let an authenticated user disclose a limited amount of memory.27
  • Stronger input validation addresses a case where an authenticated user could supply a pointer that SQL Server reads, potentially causing dump file generation or out-of-memory conditions.28
    The supplied pointer is dereferenced and read but not executed.

Improvements 7 changes

Replication

6 items
  • Replication stored procedures receive stronger internal validation and security checks.34
    The checks help ensure replication operations use the expected security safeguards.
  • Bounds validation is added for embedded attestation fields.35
  • Object Store Format deserialization is strengthened against malformed or malicious stream data.36
  • Buffer length validation checks within the enclave code are strengthened.37
  • Queued Updating Subscriptions in Transactional Replication receive security and reliability improvements.38
  • Queued Updating Subscriptions in Transactional Replication receive security and reliability improvements.39

Query Store

  • Showplan handles input in a way that improves security and reliability.40

Known issues

  1. Open Affects: Organizations and IT administrators

    Linked server queries that use MSDASQL fail with error 7416

    Linked server queries that use the MSDASQL provider and specify a provider string (@provstr) can fail with error 7416 because the connection is rejected even when earlier builds allowed it.41

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-09-08
Classification
Security Updates
Type
Cumulative update
Servicing branch
GDR
Restart
Required
Replaces
KB5102336, KB5090408, KB5084817, KB5077470
+9 earlier KB5068405, KB5065223, KB5063758, KB5058713, KB5046859, KB5046056, KB5042214, KB5040986, KB5035434
Replaced by
KB5128495
VersionBuildChannel
2019 15.0.2190.7 General availability

Security

52 vulnerabilities fixed
3 critical 49 important
VulnerabilitySeverityCVSS
CVE-2026-67631
Microsoft SQL Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-67378
Microsoft SQL Server Remote Code Execution Vulnerability
 Critical 9.0
CVE-2026-67636
Microsoft SQL Server Remote Code Execution Vulnerability
 Critical 9.0

The table lists the 3 exploited, publicly disclosed or critical vulnerabilities. See all 52 vulnerabilities →

Downloads (Microsoft Update Catalog)

Package 2019
510.2 MB
sqlserver2019-kb5122773-x64.exe Main update · KB5122773 SHA-1: 5f80b1ff…b6d461

Updated components

158 files changed since the previous update for the same versions.

Top changed componentsFiles
SQL Server Engine121
SQL Server PolyBase6

Verified in package: changed files confirm PolyBase.

Sources

Updated
Cited passages from Microsoft's official notes (41)
  1. 1. This fix addresses an unsafe deserialization in SQL Server PolyBase Engine. support.microsoft.com
  2. 2. This fix addresses a vulnerability that affects the SQL Server managed backup to the Microsoft Azure stored procedures, managed_backup.sp_get_encryption_option and managed_backup.sp_do_backup. support.microsoft.com
  3. 3. The fix prevents PolyBase services from opening raw TCP listeners for the DW Engine and DMS control and data channels if the services start by having modified command-line parameters. support.microsoft.com
  4. 4. This fix addresses an issue in which internal validation of backup metadata that's processed by the SQL Server Volume Shadow Copy Service (VSS) Writer improves handling of malformed or undersized metadata to ensure that it's rejected safely. support.microsoft.com
  5. 5. This fix addresses a security validation issue in SQL Server Agent if SQL Server Agent loads task-agent components. support.microsoft.com
  6. 6. This fix addresses reliability and security issues in SQL Server Agent if it processes specific input. support.microsoft.com
  7. 7. This fix addresses an issue in which the SQL WMI Provider processes malformed input incorrectly while preserving existing behavior for valid input. support.microsoft.com
  8. 8. This fix addresses a security vulnerability in Microsoft Entra authentication login handling in SQL Server. support.microsoft.com
  9. 9. This fix addresses validation of malformed Tabular Data Stream (TDS) and Binary XML input that's processed by SQL Server components. support.microsoft.com
  10. 10. This fix addresses identifier handling and input validation in replication stored procedures to ensure that supplied and stored values are processed correctly. support.microsoft.com
  11. 11. This fix addresses replication stored procedures that incorrectly process identifiers that contains longer or special characters. support.microsoft.com
  12. 12. This fix addresses replication stored procedures that incorrectly process identifiers that contain special characters. support.microsoft.com
  13. 13. This fix addresses input validation for a merge replication metadata stored procedure to ensure that supplied values are processed reliably. support.microsoft.com
  14. 14. This fix addresses a replication stored procedure that handles a caller-supplied path value. support.microsoft.com
  15. 15. This fix addresses input validation for parameters used by replication stored procedures to ensure that supplied values are processed reliably. support.microsoft.com
  16. 16. This fix addresses an issue that affects the security and reliability of SQL Server Agent under specific operating conditions. support.microsoft.com
  17. 17. This fix addresses an issue in which the SUBSTRING function reads beyond the allocated buffer if it processes malformed double-byte character set (DBCS) varchar input. support.microsoft.com
  18. 18. This fix addresses an issue in which converting or truncating an NVARCHAR value that contains an Ideographic Variation Sequence (IVS) under a Variation Selector Sensitive (_VSS) collation causes an access violation. support.microsoft.com
  19. 19. This fix addresses an issue in which a natively compiled stored procedure causes a heap buffer overwrite while streaming nvarchar(max) data with SET TEXTSIZE truncation under a Variation Selector Sensitive (_VSS) collation. support.microsoft.com
  20. 20. The fix prevents PolyBase services from opening raw TCP listeners for the DW Engine and DMS control and data channels if the services start by having modified command-line parameters. support.microsoft.com
  21. 21. This fix addresses an access violation that occurs if SQL Server processes a query that has an extremely large OPTION (USE PLAN) XML declaration. support.microsoft.com
  22. 22. This fix addresses a security issue in SQL Server by updating how SQL Server processes and outputs certain internal event data to help protect information. support.microsoft.com
  23. 23. This fix addresses a security issue in SQL Server in which insufficient validation in Extended Events can cause memory corruption. support.microsoft.com
  24. 24. This fix addresses an XML data type handling bug in Document Type Definition (DTD) attribute lists. support.microsoft.com
  25. 25. This fix addresses an integer overflow in the SQL Server XML reader that occurs if SQL Server processes a specially crafted XML format file through OPENROWSET(BULK...) or BULK INSERT. support.microsoft.com
  26. 26. This fix resolves several security vulnerabilities that allow information disclosure or a denial of service if the database engine reads a specially crafted Extended Events (.xel) file. support.microsoft.com
  27. 27. This fix addresses an improper input validation issue in SQL Server that allows an authenticated user to disclose a limited amount of memory. support.microsoft.com
  28. 28. This fix addresses an improper input validation issue in SQL Server in which an authenticated user can provide a pointer that SQL Server dereferences and reads but does not execute. support.microsoft.com
  29. 29. This fix addresses an issue in which the class ID lookup call reads arbitrary memory. support.microsoft.com
  30. 30. This fix addresses improper field offset validation in the SqlDataRecord.SetBytes API for sql_variant values. support.microsoft.com
  31. 31. This fix addresses an issue that affects the protection of internal replication data during processing operations. support.microsoft.com
  32. 32. This fix addresses an issue in Merge Replication that affects the handling of text data during processing operations. support.microsoft.com
  33. 33. This fix addresses an issue in replication operations that affects validation and handling to enhance security and reliability. support.microsoft.com
  34. 34. This fix improves internal validation and security checks for SQL Server replication stored procedures to ensure that replication operations are processed by using the expected security safeguards. support.microsoft.com
  35. 35. This fix adds bounds validation for embedded attestation fields. support.microsoft.com
  36. 36. This fix strengthens Object Store Format (OSF) deserialization against malformed or malicious stream data. support.microsoft.com
  37. 37. This fix strengthens buffer length validation checks within the enclave code. support.microsoft.com
  38. 38. This update includes security and reliability improvements for the Queued Updating Subscriptions in Transactional Replication. support.microsoft.com
  39. 39. This update includes security and reliability improvements for the Queued Updating Subscriptions in Transactional Replication. support.microsoft.com
  40. 40. This fix improves the handling of input to Showplan to enhance security and reliability. support.microsoft.com
  41. 41. Linked server queries that use the MSDASQL (OLE DB Provider for ODBC Drivers) provider and specify a provider string (@provstr) fail and return the following error message: support.microsoft.com
Checked automatically: 8 of 8 checks passed, 41 quoted passages · compared with Microsoft's page on Nov 14, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake