Skip to the content
The Update Bureau
SQL Server 2017 CU31 + GDR SQL Server 2017 CU31 + GDR Security update
Patch Tuesday

KB5122774

KB5122774: Security update for SQL Server 2017, CU branch, September 2026. Critical remote-code-execution flaw patched; linked queries can fail

In short

Fixes 45 vulnerabilities, including one critical SQL Server remote-code-execution flaw. Linked server queries using MSDASQL and a provider string can fail with error 7416.

Does it affect you? Applies to: SQL Server 2017 installations on Linux and Windows. The update requires SQL Server 2017 or a SQL Server 2017 CU through CU31; the package is for x64.

Build
14.0.3550.4
Servicing branch
CU
Security
45 fixed · 1 critical
Restart
Required

For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?

What changes

Fixes 25 changes

Backup Restore

2 items
  • A vulnerability affecting SQL Server managed backup procedures is addressed.1
    The affected procedures are managed_backup.sp_get_encryption_option and managed_backup.sp_do_backup.
  • Backup metadata validation rejects malformed or undersized metadata safely.11
    The validation is performed on metadata processed by the SQL Server Volume Shadow Copy Service (VSS) Writer.

SQL Agent

3 items
  • Security validation is strengthened when SQL Server Agent loads task-agent components.2
  • Reliability and security issues are addressed when SQL Server Agent processes specific input.3
  • A security and reliability issue in SQL Server Agent is addressed under specific operating conditions.9

WMI Management Provider (SqlMgmProvider)

For: SQL Server on Windows

  • The SQL WMI Provider handles malformed input correctly while preserving its handling of valid input.4

Security Infrastructure

For: SQL Server on Linux and Windows

  • A security vulnerability in Microsoft Entra authentication login handling is addressed.5

SQL Connectivity

For: SQL Server on Windows

  • SQL Server components validate malformed network and binary XML input with invalid length values.6
    The input formats are Tabular Data Stream (TDS) and Binary XML.

Replication

5 items

For: SQL Server on Linux and Windows

  • Replication stored procedures receive stronger internal validation and security checks.7
    Replication operations are processed using the expected security safeguards.
  • Input values for replication stored procedures are validated to improve reliable processing.8
  • Protection of internal replication data is improved during processing operations.23
  • Merge Replication handles text data more safely during processing operations.24
  • Validation and handling in replication operations are improved for security and reliability.25

In-Memory OLTP

3 items

For: SQL Server on Linux and Windows

  • A natively compiled stored procedure no longer overwrites heap memory while streaming truncated nvarchar(max) data under a Variation Selector Sensitive collation with small TDS packets, an issue that could stop the server responding.10
    The condition involves SET TEXTSIZE truncation and a Variation Selector Sensitive (_VSS) collation.
  • The SUBSTRING function no longer reads past its allocated buffer when a natively compiled In-Memory OLTP procedure processes malformed double-byte character set varchar input.18
  • Converting or truncating an NVARCHAR value containing an Ideographic Variation Sequence under a Variation Selector Sensitive collation no longer causes an access violation that stops the server responding.19
    The issue occurs in a natively compiled In-Memory OLTP procedure and involves a Variation Selector Sensitive (_VSS) collation.

XML

3 items

For: SQL Server on Linux and Windows

  • An extremely large OPTION (USE PLAN) XML declaration no longer causes an access violation that could terminate SQL Server unexpectedly.12
  • An XML data type handling bug in Document Type Definition attribute lists is addressed.15
    Document Type Definition (DTD) attribute lists are involved.
  • A specially crafted XML format file no longer triggers an integer overflow that could make SQL Server stop responding or terminate unexpectedly.16
    The issue could occur when processing the file through OPENROWSET(BULK...) or BULK INSERT.

Programmability

2 items
  • SQL Server changes how it processes and outputs certain internal event data to help protect information.13
  • Validation of field offsets in the SqlDataRecord.SetBytes API for sql_variant values is corrected, preventing an out-of-bounds heap write that could cause denial of service or elevation of privilege.22
    This affects SQL Server installations and Azure SQL Managed Instances with common language runtime (CLR) enabled.

Extended Events

2 items

For: SQL Server on Linux and Windows

  • Insufficient validation in Extended Events is addressed to prevent memory corruption.14
  • Several security vulnerabilities that could expose information or cause a denial of service when the database engine reads a specially crafted Extended Events file are resolved.17
    The affected files use the .xel extension.

Query Execution

For: SQL Server on Linux and Windows

  • Input validation is strengthened so an authenticated user cannot cause SQL Server to dereference and read a supplied pointer, which could lead to dump-file generation or out-of-memory conditions.20
    The pointer is read but not executed.

Query Store

For: SQL Server on Windows

  • Showplan handles input more securely and reliably.21

Improvements 2 changes

Replication

2 items

For: SQL Server on Windows

  • Queued Updating Subscriptions in Transactional Replication receive security and reliability improvements.26
  • Queued Updating Subscriptions in Transactional Replication receive security and reliability improvements.27

Known issues

  1. Open Affects: Organizations and IT administrators

    Linked server queries that use MSDASQL fail with error 7416

    Linked server queries using the MSDASQL provider and specifying a provider string (@provstr) fail with error 7416: access to the remote server is denied because no login mapping exists. Stricter Database Engine connection validation can reject some configurations that worked in earlier builds.28

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-09-08
Classification
Security Updates
Type
Cumulative update
Servicing branch
CU
Restart
Required
Replaces
KB5102337, KB5090354, KB5084818, KB5077471
+9 earlier KB5068402, KB5065225, KB5063759, KB5058714, KB5050533, KB5046858, KB5046061, KB5042215, KB5040940
Replaced by
KB5128496
VersionBuildChannel
2017 14.0.3550.4 General availability

Security

45 vulnerabilities fixed
1 critical 44 important
VulnerabilitySeverityCVSS
CVE-2026-67631
Microsoft SQL Server Remote Code Execution Vulnerability
 Critical 9.8

The table lists the 1 exploited, publicly disclosed or critical vulnerabilities. See all 45 vulnerabilities →

Downloads (Microsoft Update Catalog)

Package 2017
543.0 MB
sqlserver2017-kb5122774-x64.exe Main update · KB5122774 SHA-1: c4decc7c…86163e

Updated components

124 files changed since the previous update for the same versions.

Top changed componentsFiles
SQL Server Engine94
SQL Server PolyBase2

Sources

Updated
Cited passages from Microsoft's official notes (28)
  1. 1. This fix addresses a vulnerability that affects the SQL Server managed backup to the Microsoft Azure stored procedures, managed_backup.sp_get_encryption_option and managed_backup.sp_do_backup. support.microsoft.com
  2. 2. This fix addresses a security validation issue in SQL Server Agent if SQL Server Agent loads task-agent components. This fix strengthens security validation. support.microsoft.com
  3. 3. This fix addresses reliability and security issues in SQL Server Agent if it processes specific input. support.microsoft.com
  4. 4. This fix addresses an issue in which the SQL WMI Provider processes malformed input incorrectly while preserving existing behavior for valid input. support.microsoft.com
  5. 5. This fix addresses a security vulnerability in Microsoft Entra authentication login handling in SQL Server. support.microsoft.com
  6. 6. This fix addresses validation of malformed Tabular Data Stream (TDS) and Binary XML input that's processed by SQL Server components. The input contains invalid length values that can cause unexpected behavior. support.microsoft.com
  7. 7. This fix improves internal validation and security checks for SQL Server replication stored procedures to ensure that replication operations are processed by using the expected security safeguards. support.microsoft.com
  8. 8. This fix addresses input validation for parameters that are used by replication stored procedures to ensure that supplied values are processed reliably. support.microsoft.com
  9. 9. This fix addresses an issue that affects the security and reliability of SQL Server Agent under specific operating conditions. support.microsoft.com
  10. 10. This fix addresses an issue in which a natively compiled stored procedure causes a heap buffer overwrite while streaming nvarchar(max) data that has SET TEXTSIZE truncation under a Variation Selector Sensitive (_VSS) collation. support.microsoft.com
  11. 11. This fix addresses an issue in which internal validation of backup metadata that's processed by the SQL Server Volume Shadow Copy Service (VSS) Writer improves handling of malformed or undersized metadata to ensure that it's rejected safely. support.microsoft.com
  12. 12. This fix addresses an access violation that occurs if SQL Server processes a query that has an extremely large OPTION (USE PLAN) XML declaration. support.microsoft.com
  13. 13. This fix addresses a security issue in SQL Server by updating how SQL Server processes and outputs certain internal event data to help protect information. support.microsoft.com
  14. 14. This fix addresses a security issue in SQL Server in which insufficient validation in Extended Events can cause memory corruption. support.microsoft.com
  15. 15. This fix addresses an XML data type handling bug in Document Type Definition (DTD) attribute lists. support.microsoft.com
  16. 16. This fix addresses an integer overflow in the SQL Server XML reader that occurs if SQL Server processes a specially crafted XML format file through OPENROWSET(BULK...) or BULK INSERT. support.microsoft.com
  17. 17. This fix resolves several security vulnerabilities that allow information disclosure or a denial of service if the database engine reads a specially crafted Extended Events (.xel) file. support.microsoft.com
  18. 18. This fix addresses an issue in which the SUBSTRING function reads beyond the allocated buffer if it processes malformed double-byte character set (DBCS) varchar input. support.microsoft.com
  19. 19. This fix addresses an issue in which converting or truncating an NVARCHAR value that contains an Ideographic Variation Sequence (IVS) under a Variation Selector Sensitive (_VSS) collation causes an access violation. support.microsoft.com
  20. 20. This fix addresses an improper input validation issue in SQL Server in which an authenticated user can provide a pointer that SQL Server dereferences and reads but does not execute. support.microsoft.com
  21. 21. This fix improves the handling of input to Showplan to enhance security and reliability. support.microsoft.com
  22. 22. This fix addresses improper field offset validation in the SqlDataRecord.SetBytes API for sql_variant values. This fix prevents an out-of-bounds heap write that can cause denial of service or elevation of privilege in SQL Server installations and Azure SQL Managed Instances that have common language runtime (CLR) enabled. support.microsoft.com
  23. 23. This fix addresses an issue that affects the protection of internal replication data during processing operations. support.microsoft.com
  24. 24. This fix addresses an issue in Merge Replication that affects the handling of text data during processing operations. support.microsoft.com
  25. 25. This fix addresses an issue in replication operations that affects validation and handling to enhance security and reliability. support.microsoft.com
  26. 26. This update includes security and reliability improvements for the Queued Updating Subscriptions in Transactional Replication. support.microsoft.com
  27. 27. This update includes security and reliability improvements for the Queued Updating Subscriptions in Transactional Replication. support.microsoft.com
  28. 28. Linked server queries that use the MSDASQL (OLE DB Provider for ODBC Drivers) provider and specify a provider string (@provstr) fail and return the following error message: support.microsoft.com
Checked automatically: 8 of 8 checks passed, 28 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake