Skip to the content
The Update Bureau
SQL Server 2017 GDR SQL Server 2017 GDR Security update
Patch Tuesday

KB5122775

KB5122775: Security update for SQL Server 2017, GDR branch, September 2026. Database Engine remote-code flaw patched; linked-server error remains

In short

The update fixes 45 vulnerabilities, including one Critical SQL Server remote-code execution flaw. Linked-server queries using MSDASQL and a provider string can still fail with error 7416.

Does it affect you? Applies to: SQL Server 2017 installations using the GDR servicing branch. The listed package is for x64 systems; the update requires SQL Server 2017 or a SQL Server 2017 GDR release to be installed.

Build
14.0.2130.4
Servicing branch
GDR
Security
45 fixed · 1 critical
Restart
Required
Review notes Additional details from the official release notes (2) Read notes
  • Known issues This issue affects SQL Server linked-server queries that use MSDASQL and specify a provider string; it does not affect all users.
  • What to do KB5122775 was superseded by KB5128497 on October 16, 2026.

The official sources are linked at the end of the page.

For servers on the GDR branch: they get security fixes only. Servers that install cumulative updates (CU branch) get a separate update. Which branch am I on?

What changes

Fixes 32 changes

Backup Restore

  • Managed backup to Microsoft Azure stored procedures receive a security fix.1
    Addresses a vulnerability affecting managed_backup.sp_get_encryption_option and managed_backup.sp_do_backup. Customers using managed backup should apply the update through the standard SQL Server servicing process.

SQL Agent

3 items
  • SQL Server Agent gets stronger security validation when it loads task-agent components.2
    Addresses a security validation issue when SQL Server Agent loads task-agent components.
  • SQL Server Agent receives reliability and security fixes when processing specific input.3
  • SQL Server Agent receives a security and reliability fix for specific operating conditions.18

WMI Management Provider (SqlMgmProvider)

  • The SQL WMI Provider handles malformed input correctly while preserving its handling of valid input.4

Security Infrastructure

  • Microsoft Entra authentication login handling receives a security fix.5

SQL Connectivity

  • SQL Server components validate malformed Tabular Data Stream and Binary XML input containing invalid length values.6
    Addresses validation of malformed Tabular Data Stream (TDS) and Binary XML input processed by SQL Server components.

Replication

14 items
  • Replication stored procedures handle supplied and stored identifiers more reliably.7
    Addresses identifier handling and input validation in replication stored procedures.
  • Replication stored procedures handle identifiers with longer or special characters correctly.8
  • Replication stored procedures handle identifiers containing special characters correctly.9
  • A merge replication metadata stored procedure validates supplied values more reliably.10
  • A replication stored procedure gets a fix for handling a caller-supplied path.11
  • Replication stored procedures handle supplied and stored identifiers more reliably.12
    Addresses identifier handling and input validation in replication stored procedures.
  • Replication stored procedures handle identifiers with longer or special characters correctly.13
  • Replication stored procedures handle identifiers containing special characters correctly.14
  • A merge replication metadata stored procedure validates supplied values more reliably.15
  • A replication stored procedure gets a fix for handling a caller-supplied path.16
  • Replication stored procedure parameters get improved input validation.17
  • Replication operations better protect internal replication data during processing.30
  • Merge Replication gets a fix for handling text data during processing.31
  • Replication operations get improved validation and handling for security and reliability.32

In-Memory OLTP

3 items
  • The server is less likely to stop responding when a natively compiled procedure streams truncated nvarchar(max) data under a Variation Selector Sensitive collation with small TDS packets.19
    Addresses a heap buffer overwrite while streaming nvarchar(max) data subject to SET TEXTSIZE truncation under a Variation Selector Sensitive (_VSS) collation.
  • The SUBSTRING function no longer reads beyond its allocated buffer when processing malformed DBCS varchar input in a natively compiled procedure.26
    Addresses this issue in a natively compiled In-Memory OLTP procedure.
  • Converting or truncating an NVARCHAR value with an Ideographic Variation Sequence under a Variation Selector Sensitive collation is less likely to cause an access violation and stop the server.27
    Addresses an access violation in a natively compiled In-Memory OLTP procedure when handling an NVARCHAR value under a Variation Selector Sensitive (_VSS) collation.

XML

3 items
  • A query with an extremely large OPTION (USE PLAN) XML declaration is less likely to terminate SQL Server unexpectedly.20
    Addresses an access violation when SQL Server processes a query with an extremely large OPTION (USE PLAN) XML declaration.
  • SQL Server corrects an XML data type handling bug in DTD attribute lists.23
    Addresses a Document Type Definition (DTD) attribute list handling bug in the XML data type.
  • A specially crafted XML format file is less likely to make SQL Server stop responding or terminate unexpectedly during bulk loading.24
    Addresses an integer overflow in the XML reader when processing specially crafted XML format files through OPENROWSET(BULK...) or BULK INSERT.

Programmability

2 items
  • SQL Server gets a security fix for processing and outputting certain internal event data.21
  • The SqlDataRecord.SetBytes API validates field offsets for sql_variant values, preventing an out-of-bounds heap write that could cause denial of service or elevation of privilege.29
    Applies to SQL Server installations and Azure SQL Managed Instances with common language runtime (CLR) enabled.

Extended Events

2 items
  • A security fix addresses memory corruption caused by insufficient validation in Extended Events.22
  • The database engine gets fixes for vulnerabilities that could disclose information or cause denial of service when it reads a specially crafted .xel file.25

Query Execution

  • SQL Server validates input more carefully when an authenticated user supplies a pointer, reducing the risk of dump file generation or out-of-memory conditions.28
    Addresses improper input validation when SQL Server dereferences and reads, but does not execute, a pointer provided by an authenticated user.

Improvements 5 changes

Replication

3 items
  • Replication stored procedures get stronger internal validation and security checks.33
  • Queued Updating Subscriptions in Transactional Replication receive security and reliability improvements.35
  • Queued Updating Subscriptions in Transactional Replication receive security and reliability improvements.36

Backup Restore

  • SQL Server safely rejects malformed or undersized backup metadata processed by the VSS Writer.34
    Improves internal validation of backup metadata processed by the SQL Server Volume Shadow Copy Service (VSS) Writer.

Query Store

  • Showplan handles input with improved security and reliability.37

Known issues

  1. Open Affects: Everyone

    Linked server queries that use MSDASQL fail with error 7416

    Linked-server queries that use the MSDASQL provider and specify a provider string (@provstr) fail with error 7416 because no login mapping exists. A stricter Database Engine connection check can reject some configurations that worked in earlier builds.38

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-09-08
Classification
Security Updates
Type
Cumulative update
Servicing branch
GDR
Restart
Required
Replaces
KB5102338, KB5090347, KB5084819, KB5077472
+8 earlier KB5068403, KB5065224, KB5063760, KB5058716, KB5046857, KB5046058, KB5042217, KB5040942
Replaced by
KB5128497
VersionBuildChannel
2017 14.0.2130.4 General availability

Security

45 vulnerabilities fixed
1 critical 44 important
VulnerabilitySeverityCVSS
CVE-2026-67631
Microsoft SQL Server Remote Code Execution Vulnerability
 Critical 9.8

The table lists the 1 exploited, publicly disclosed or critical vulnerabilities. See all 45 vulnerabilities →

Downloads (Microsoft Update Catalog)

Package 2017
459.1 MB
sqlserver2017-kb5122775-x64.exe Main update · KB5122775 SHA-1: 1fcdc9bf…c9c744

Updated components

120 files changed since the previous update for the same versions.

Top changed componentsFiles
SQL Server Engine91

Sources

Updated
Cited passages from Microsoft's official notes (38)
  1. 1. This fix addresses a vulnerability that affects the SQL Server managed backup to Microsoft Azure stored procedures managed_backup.sp_get_encryption_option and managed_backup.sp_do_backup. support.microsoft.com
  2. 2. This fix addresses a security validation issue in SQL Server Agent if SQL Server Agent loads task-agent components. This fix strengthens security validation. support.microsoft.com
  3. 3. This fix addresses reliability and security issues in SQL Server Agent if it processes specific input. support.microsoft.com
  4. 4. This fix addresses an issue in which the SQL WMI Provider processes malformed input incorrectly while preserving existing behavior for valid input. support.microsoft.com
  5. 5. This fix addresses a security vulnerability in Microsoft Entra authentication login handling in SQL Server. support.microsoft.com
  6. 6. This fix addresses validation of malformed Tabular Data Stream (TDS) and Binary XML input processed by SQL Server components. support.microsoft.com
  7. 7. This fix addresses identifier handling and input validation in replication stored procedures to ensure that supplied and stored values are processed correctly. support.microsoft.com
  8. 8. This fix addresses replication stored procedures that incorrectly process identifiers that contains longer or special characters. support.microsoft.com
  9. 9. This fix addresses replication stored procedures that incorrectly process identifiers that contain special characters. support.microsoft.com
  10. 10. This fix addresses input validation for a merge replication metadata stored procedure to ensure that supplied values are processed reliably. support.microsoft.com
  11. 11. This fix addresses a replication stored procedure that handles a caller-supplied path value. support.microsoft.com
  12. 12. This fix addresses identifier handling and input validation in replication stored procedures to ensure that supplied and stored values are processed correctly. support.microsoft.com
  13. 13. This fix addresses replication stored procedures that incorrectly process identifiers that contains longer or special characters. support.microsoft.com
  14. 14. This fix addresses replication stored procedures that incorrectly process identifiers that contain special characters. support.microsoft.com
  15. 15. This fix addresses input validation for a merge replication metadata stored procedure to ensure that supplied values are processed reliably. support.microsoft.com
  16. 16. This fix addresses a replication stored procedure that handles a caller-supplied path value. support.microsoft.com
  17. 17. This fix addresses input validation for parameters that are used by replication stored procedures to ensure that supplied values are processed reliably. support.microsoft.com
  18. 18. This fix addresses an issue that affects the security and reliability of SQL Server Agent under specific operating conditions. support.microsoft.com
  19. 19. This fix addresses an issue in which a natively compiled stored procedure causes a heap buffer overwrite while streaming nvarchar(max) data that has SET TEXTSIZE truncation under a Variation Selector Sensitive (_VSS) collation. support.microsoft.com
  20. 20. This fix addresses an access violation that occurs if SQL Server processes a query that has an extremely large OPTION (USE PLAN) XML declaration. support.microsoft.com
  21. 21. This fix addresses a security issue in SQL Server by updating how SQL Server processes and outputs certain internal event data to help protect information. support.microsoft.com
  22. 22. This fix addresses a security issue in SQL Server in which insufficient validation in Extended Events can cause memory corruption. support.microsoft.com
  23. 23. This fix addresses an XML data type handling bug in Document Type Definition (DTD) attribute lists. support.microsoft.com
  24. 24. This fix addresses an integer overflow in the SQL Server XML reader that occurs if SQL Server processes a specially crafted XML format file through OPENROWSET(BULK...) or BULK INSERT. support.microsoft.com
  25. 25. This fix resolves several security vulnerabilities that allow information disclosure or a denial of service if the database engine reads a specially crafted Extended Events (.xel) file. support.microsoft.com
  26. 26. This fix addresses an issue in which the SUBSTRING function reads beyond the allocated buffer if it processes malformed double-byte character set (DBCS) varchar input. support.microsoft.com
  27. 27. This fix addresses an issue in which converting or truncating an NVARCHAR value that contains an Ideographic Variation Sequence (IVS) under a Variation Selector Sensitive (_VSS) collation causes an access violation. support.microsoft.com
  28. 28. This fix addresses an improper input validation issue in SQL Server in which an authenticated user can provide a pointer that SQL Server dereferences and reads but does not execute. support.microsoft.com
  29. 29. This fix addresses improper field offset validation in the SqlDataRecord.SetBytes API for sql_variant values. support.microsoft.com
  30. 30. This fix addresses an issue that affects the protection of internal replication data during processing operations. support.microsoft.com
  31. 31. This fix addresses an issue in Merge Replication that affects the handling of text data during processing operations. support.microsoft.com
  32. 32. This fix addresses an issue in replication operations that affects validation and handling to enhance security and reliability. support.microsoft.com
  33. 33. This fix improves internal validation and security checks for SQL Server replication stored procedures to ensure that replication operations are processed to have the expected security safeguards. support.microsoft.com
  34. 34. This fix addresses an issue in which internal validation of backup metadata that's processed by the SQL Server Volume Shadow Copy Service (VSS) Writer improves handling of malformed or undersized metadata to ensure that it's rejected safely. support.microsoft.com
  35. 35. This update includes security and reliability improvements for the Queued Updating Subscriptions in Transactional Replication. support.microsoft.com
  36. 36. This update includes security and reliability improvements for the Queued Updating Subscriptions in Transactional Replication. support.microsoft.com
  37. 37. This fix improves the handling of input to Showplan to enhance security and reliability. support.microsoft.com
  38. 38. Linked server queries that use the MSDASQL (OLE DB Provider for ODBC Drivers) provider and specify a provider string (@provstr) fail and return the following error message: support.microsoft.com
Checked automatically: 8 of 8 checks passed, 38 quoted passages · compared with Microsoft's page on Nov 14, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake