Skip to the content
The Update Bureau
SQL Server 2025 CU10 SQL Server 2025 CU10 Cumulative update

KB5125471

KB5125471: Cumulative update for SQL Server 2025, CU branch, October 2026. Recovery checks can trigger access violations

In short

Queries against sys.dm_exec_requests during database recovery can trigger access violations and dump files. CU10 also leaves open an issue where parallel SESSION_CONTEXT queries can return wrong results.

Does it affect you? Applies to: SQL Server 2025 instances on Windows or Linux. The package updates only features already installed on the instance; it applies to all supported languages.

Build
17.0.5035.5
Servicing branch
CU
Restart
Required

For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?

What changes

Fixes 21 changes

Methods to access stored data

  • Self-updating a small XML column with XML compression no longer corrupts its data or causes a transport-level error when selected.1
    Fixes the issue for small off-row XML columns with XML compression enabled. Bug reference 5090700.

Programmability

3 items
  • Creating a JSON index on a long path with multibyte Unicode characters no longer causes SQL Server to end unexpectedly when the converted path exceeds 8,000 bytes.2
    Bug reference 5318463. The limit applies after UTF-8 conversion.
  • A SqlDataRecord.SetBytes issue that could write past the end of memory for sql_variant values is fixed.7
    Windows only. Fixes improper field offset validation when CLR integration is turned on. Bug reference 5529171.
  • Malformed trace data no longer causes an out-of-bounds read when SQL Trace processes the LoginSid column.21
    Bug reference 5635965.

PolyBase

3 items
  • PolyBase better checks data during processing to fix a security vulnerability.3
    Bug reference 5419454.
  • Accessing external data sources no longer causes the SQL Server process to end unexpectedly.4
    Bug reference 5439307.
  • Malformed PolyBase rollback queue data is rejected instead of being unsafely deserialized.14
    Bug reference 5575381.

Backup Restore

4 items
  • Malformed size values in VDI and SQL Server VSS Writer backup operations no longer cause out-of-bounds memory access.5
    Windows only. Fixes input validation in Virtual Device Interface (VDI) and SQL Server VSS Writer backup operations. Bug reference 5491072.
  • A backup and restore metadata issue that could let an authenticated local user gain higher privileges or stop a service from responding is addressed.6
    Windows only. Addresses integer handling in backup and restore metadata processing. Bug reference 5494339.
  • A VDI security flaw that could write beyond allocated memory when opening a virtual device set is fixed.11
    Bug reference 5571219.
  • A VDI security flaw that could read or write beyond allocated memory while processing backup or restore data is fixed.12
    Bug reference 5571935.

Replication

6 items
  • Change Event Streaming can deserialize event data that contains certain characters.8
    Fixes the deserialization issue for event data payloads containing certain characters. Bug reference 5529458.
  • SQL Server dump files caused by streaming large object data through Change Event Streaming are fixed.9
    Fixes dump files that might occur during serialization of streamed large object data. Bug reference 5529462.
  • Merge replication web synchronization no longer causes a buffer overflow when processing more than 250 XML nickname entries.17
    Bug reference 5632851.
  • A replication issue that affects data validation is fixed.18
    Bug reference 5632877.
  • A data validation issue in merge replication web synchronization is fixed.19
    Bug reference 5632890.
  • An issue processing Change Event Streaming input data is fixed.20
    Bug reference 5632903.

Linux

For: SQL Server on Linux

  • Creating a contained availability group no longer fails with error 1803 after a first-boot collation change on SQL Server for Linux.10
    Bug reference 5555143.

Extensibility

2 items
  • An invalid memory read in AI_GENERATE_EMBEDDINGS runtime parameter processing is fixed.13
    Bug reference 5574835.
  • Memory corruption and disclosure vulnerabilities in SQLSatellite protocol message parsing are fixed.15
    The protocol is used by Machine Learning Services and Language Extensions. Bug reference 5578870.

Distributed Query

  • Linked server connections using MSDASQL no longer fail when the provider string has no user ID.16
    The provider string can omit UID. Bug reference 5582011.

Improvements 15 changes

Extensibility

  • The archive extraction component used to install external language and library packages is updated.22
    Bug reference 5505572.

High Availability and Disaster Recovery

For: Availability group users

  • Availability group secondary replicas now reject oversized FILESTREAM fragments.23
    Adds validation of FILESTREAM fragment sizes. Bug reference 5522142.

Query Store

For: Windows

  • Showplan input is handled more safely and reliably.24
    Windows only. Bug reference 5529204.

Replication

10 items
  • Internal replication data is better protected during processing.25
    Bug reference 5529345.
  • Merge replication handles text data more safely and reliably.26
    Bug reference 5529358.
  • Replication operations get better validation and handling for improved security and reliability.27
    Bug reference 5529370.
  • Queued updating subscriptions in transactional replication get better security and reliability.28
    Windows only. Bug reference 5529381.
  • Queued updating subscriptions in transactional replication get better security and reliability.29
    Windows only. Bug reference 5529395.
  • Replication security metadata is handled more securely and reliably during subscriber database restore and upgrade.32
    Windows only. Bug reference 5632692.
  • The Log Reader Agent is more secure and reliable in heterogeneous transactional replication setups.33
    Windows only. Bug reference 5632803.
  • Change feed configuration is more secure and reliable.34
    Windows only. Bug reference 5632816.
  • The sp_replcounters stored procedure gets improved security.35
    Windows only. Bug reference 5632930.
  • Stored procedures used by merge replication get better security validation.36
    Windows only. Bug reference 5635187.

PolyBase

2 items
  • PolyBase now checks Delta Lake table schema metadata.30
    Adds validation of Delta Lake table schema metadata. Bug reference 5555768.
  • PolyBase handles shared memory better.31
    Bug reference 5558665.

New feature 1 change

Programmability

  • SQL Server on Linux can map Windows time-zone IDs to new and updated IANA time zones.37
    Mappings include British Columbia, Alberta, Manitoba, Magallanes, FLE, Qyzylorda, and Central Asia. Bug reference 5749934.

Known issues

  1. Open Affects: Everyone

    Access violation when you query sys.dm_exec_requests during database recovery

    Queries against sys.dm_exec_requests might cause an access violation and dump file while a database is recovering, during RESTORE, startup recovery, or before an availability group replica comes online.38

    How to apply the workaround SQL Trace Flag

    Enable trace flag 4696 to opt out of the code change, avoid querying sys.dm_exec_requests for recovering databases, or uninstall the update. With the trace flag, monitoring queries on secondary replicas might return error 976 or 978, as before the update.38

  2. Open Affects: Everyone

    Incorrect behavior of SESSION_CONTEXT in parallel plans

    Queries using SESSION_CONTEXT might return incorrect results or create access violation dump files when run in parallel query plans, especially if a session is reset for reuse.39

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-10-22
Classification
Updates
Type
Cumulative update
Servicing branch
CU
Restart
Required
Replaces
KB5122048, KB5104822, KB5096981, KB5093421
+5 earlier KB5084896, KB5081495, KB5077896, KB5075211, KB5078298
Replaced by
KB5129299
VersionBuildChannel
2025 17.0.5035.5 General availability

Security

No vulnerabilities are listed for this update.

Downloads (Microsoft Update Catalog)

Package 2025
415.6 MB
sqlserver2025-kb5125471-x64.exe Main update · KB5125471 SHA-1: 9f238596…1718f8

Updated components

251 files changed since the previous update for the same versions.

Top changed componentsFiles
SQL Server Engine71
SQL Server Integration Services24
SQL Server Replication12
SQL Server Agent4
SQL Server Machine Learning Services4
SQL Server PolyBase4
SQL Server Full-Text Search2

Page history

  1. Superseded by KB5129299

  2. Now also covers build 17.0.5035.5 (2025)

Sources

Updated
Cited passages from Microsoft's official notes (39)
  1. 1. Fixes an issue in which a self-assignment update on a small off-row XML column that has XML compression enabled causes XML data corruption and a transport-level error when the data is selected. support.microsoft.com
  2. 2. Fixes an issue in which creating a JSON index on a long JSON path that contains multibyte Unicode characters can cause SQL Server to end unexpectedly if the path exceeds 8,000 bytes after UTF-8 conversion. support.microsoft.com
  3. 3. Fixes a security vulnerability in PolyBase by improving validation during data processing. support.microsoft.com
  4. 4. Fixes an issue in which the SQL Server process might end unexpectedly when it accesses external data sources. support.microsoft.com
  5. 5. Fixes an input validation issue in which malformed size values in Virtual Device Interface (VDI) and SQL Server VSS Writer backup operations can cause out-of-bounds memory access. support.microsoft.com
  6. 6. Addresses an integer handling issue in SQL Server backup and restore metadata processing that potentially allows a local authenticated user to gain elevated privileges and cause a service to stop responding. support.microsoft.com
  7. 7. Fixes improper field offset validation in the SqlDataRecord.SetBytes API for sql_variant values that can cause an out-of-bounds heap write action if CLR integration is turned on. support.microsoft.com
  8. 8. Fixes an issue in Change Event Streaming (CES) that prevents event deserialization if event data payloads contain certain characters. support.microsoft.com
  9. 9. Fixes SQL Server dump files that might occur during serialization of large object data that's streamed through Change Event Streaming. support.microsoft.com
  10. 10. Fixes an issue in which creating a contained availability group might fail and return an "1803" error message after a first-boot collation change on SQL Server on Linux. support.microsoft.com
  11. 11. Fixes a security vulnerability in the SQL Server Virtual Device Interface (VDI) in which an out-of-bounds write action might occur when a virtual device set is opened. support.microsoft.com
  12. 12. Fixes a security vulnerability in the SQL Server Virtual Device Interface (VDI) in which an out-of-bounds read or write action might occur when transferred data is processed during backup or restore operations. support.microsoft.com
  13. 13. Fixes an invalid memory read vulnerability in the processing of runtime parameters for the AI_GENERATE_EMBEDDINGS function. support.microsoft.com
  14. 14. Fixes unsafe deserialization of PolyBase rollback queue data so that malformed payloads are rejected. support.microsoft.com
  15. 15. Fixes multiple memory corruption and memory disclosure vulnerabilities in the parsing of SQLSatellite protocol messages that Machine Learning Services and Language Extensions use. support.microsoft.com
  16. 16. Fixes an issue in which linked server connections that use the MSDASQL provider might fail if the provider string doesn't include a user ID (UID). support.microsoft.com
  17. 17. Fixes a buffer overflow that occurs when merge replication processes more than 250 XML nickname entries during web synchronization. support.microsoft.com
  18. 18. Fixes an issue in replication operations that affects data validation. support.microsoft.com
  19. 19. Fixes an issue that affects data validation in Web synchronization operations for merge replication. support.microsoft.com
  20. 20. Fixes an issue in the processing of input data for Change Event Streaming. support.microsoft.com
  21. 21. Fixes an issue in which malformed trace data can cause an out-of-bounds read action when SQL Trace processes the LoginSid column. support.microsoft.com
  22. 22. Updates the third-party archive extraction component that SQL Server uses to install external language and external library packages. support.microsoft.com
  23. 23. Adds validation of FILESTREAM fragment sizes on availability group secondary replicas to reject oversized fragments. support.microsoft.com
  24. 24. Improves the handling of Showplan input to enhance security and reliability. support.microsoft.com
  25. 25. Improves the protection of internal replication data during processing operations. support.microsoft.com
  26. 26. Improves the handling of text data in merge replication to enhance security and reliability. support.microsoft.com
  27. 27. Improves the validation and handling of replication operations to enhance security and reliability. support.microsoft.com
  28. 28. Improves the security and reliability of queued updating subscriptions in transactional replication. support.microsoft.com
  29. 29. Improves the security and reliability of queued updating subscriptions in transactional replication. support.microsoft.com
  30. 30. Adds validation of Delta Lake table schema metadata. support.microsoft.com
  31. 31. Improves the handling of shared memory in PolyBase. support.microsoft.com
  32. 32. Improves the security and reliability of replication security metadata handling during subscriber database restore and upgrade operations. support.microsoft.com
  33. 33. Improves the security and reliability of the Log Reader Agent in heterogeneous transactional replication scenarios. support.microsoft.com
  34. 34. Improves the security and reliability of the change feed configuration. support.microsoft.com
  35. 35. Improves the security of the sp_replcounters stored procedure. support.microsoft.com
  36. 36. Improves security validation for stored procedures that merge replication uses. support.microsoft.com
  37. 37. Adds support for new and updated time zones by mapping Windows time zone IDs to Internet Assigned Numbers Authority (IANA) time zones. The mappings include British Columbia, Alberta, Manitoba, Magallanes, FLE, Qyzylorda, and Central Asia. support.microsoft.com
  38. 38. Enable trace flag 4696 to opt out of the code change that causes this issue. If you enable this trace flag, monitoring queries that query sys.dm_exec_requests or sys.sysprocesses on secondary replicas might return error 976 or error 978, as they did before you installed this update. support.microsoft.com
  39. 39. This issue occurs because of the manner in which SESSION_CONTEXT interacts with parallel execution threads, particularly if the session is reset for reuse. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 39 quoted passages · compared with Microsoft's page on Nov 14, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake