KB5125472: Cumulative update for SQL Server 2022, CU branch, November 2026. Replication safeguards, SQL engine fixes, and new link tools

For: Windows availability-group deployments

• Monitoring queries on read-intent-only secondary replicas no longer intermittently fail with errors 976 or 978.¹
  Fixes failures in queries that use sys.dm_exec_requests or sys.sysprocesses on an availability-group read-intent-only secondary replica.
• An availability-group listener using a DHCP address can come online.⁵
  Fixes an availability group listener that doesn't come online when it uses a Dynamic Host Configuration Protocol (DHCP) address.

For: SQL Server instances with approximately 20 TB or more of memory

• Online operations and database recovery perform better on instances with about 20 TB or more of memory.²
  Fixes performance degradation on instances configured with approximately 20 TB or more of memory.

For: Windows instances using Always Encrypted

• Decrypting empty or NULL values in Always Encrypted large-value columns no longer causes error 33550, state 42.³
  Fixes error 33550, state 42, when a secure enclave decrypts empty or NULL values in varchar(max), nvarchar(max), or varbinary(max) columns using Always Encrypted.

For: All platforms

• The SQL Server process is less likely to end unexpectedly when it accesses external data sources.⁴
  Fixes unexpected SQL Server process termination when accessing external data sources.

• Malformed size values in VDI and VSS Writer backups no longer cause out-of-bounds memory access.⁶
  Fixes input validation for malformed size values in Virtual Device Interface (VDI) and SQL Server VSS Writer backup operations.
• Malformed or oversized backup metadata is less likely to stop SQL Server or allow higher privileges.⁷
  Fixes integer handling in backup and restore metadata processing; malformed or oversized input could cause SQL Server to end unexpectedly or permit elevation of privilege.
• Opening a SQL Server VDI virtual device set no longer allows an out-of-bounds memory write.¹⁰
  Fixes a security vulnerability involving an out-of-bounds memory write when opening a SQL Server Virtual Device Interface (VDI) virtual device set.
• VDI backup or restore data can no longer make SQL Server access memory outside its allocated buffer.¹¹
  Fixes a security vulnerability involving out-of-bounds memory access while processing data transferred during VDI backup or restore operations.
• An oversized user instance name in SQL Server VSS Writer no longer disrupts backups or snapshots or causes an out-of-bounds write.²⁵
  Fixes input validation for oversized user instance names in SQL Server VSS Writer backup operations.

For: All platforms

• The hadr_log_block_decompression event reports different compressed and uncompressed log block sizes when they differ.⁸
  Fixes the hadr_log_block_decompression extended event reporting the same value for compressed and uncompressed log block sizes.
• Heavy lazy-writer I/O is less likely to cause non-yielding scheduler errors and dump files.²⁷
  Fixes non-yielding scheduler errors and dump files that might occur during heavy lazy writer I/O activity.

• Using SqlDataRecord.SetBytes with sql_variant values no longer allows an out-of-bounds memory write that could cause denial of service or higher privileges.⁹
  Fixes an out-of-bounds memory write in the SqlDataRecord.SetBytes API for sql_variant values when CLR integration is enabled.
• XML operations no longer cause a heap buffer overflow.¹⁷
  Fixes a heap buffer overflow during XML operation.
• ALTER DATABASE CURRENT ADD FILE works on Azure SQL Managed Instance General Purpose and Next-gen General Purpose tiers.²⁸
  Fixes ALTER DATABASE CURRENT ADD FILE failing with error 42019 on Azure SQL Managed Instance General Purpose and Next-gen General Purpose service tiers.

For: All platforms

• Memory corruption and information disclosure flaws in SQLSatellite processing are fixed.¹²
  Fixes memory corruption and information disclosure vulnerabilities in SQLSatellite protocol processing used by Machine Learning Services and Language Extensions.

For: All platforms

• MSDASQL linked-server connections work when the provider string has no user ID.¹³
  Fixes MSDASQL-linked server connection failures when the provider string doesn't include a user ID (UID).

For: Windows

• Some MDX queries over ragged hierarchies no longer omit hidden leaf members, which could cause missing rows or lower totals.¹⁴
  Fixes nested-subselect MDX queries over HideMemberIf-configured ragged hierarchies omitting hidden leaf members.

For: All platforms

• Certain client connection requests no longer cause an out-of-bounds memory read.¹⁵
  Fixes an out-of-bounds memory read that can occur when SQL Server processes certain client connection requests.

• CDC and transactional replication can process consecutive clustered-key updates to rows with large off-row values.¹⁶
  Fixes failures processing consecutive clustered-key updates to rows with large off-row large object (LOB) values.
• Merge replication checks authorization for row metadata more safely.²⁰
  Fixes a security issue in authorization checks for merge replication row metadata.
• Merge replication no longer overflows a buffer when it processes more than 250 WebSync XML nickname entries.²¹
  Fixes a buffer overflow when merge replication processes more than 250 WebSync XML nickname entries.
• An information disclosure flaw in the replication queue command decoder is fixed.²⁹
  Fixes an information disclosure vulnerability in the xp_decodequeuecmd replication queue command decoder.
• The Log Reader Agent no longer causes a heap buffer overflow when it escapes single quotation marks in column values.³⁰
  Fixes a heap buffer overflow when the Log Reader Agent escapes single quotation marks in column values.
• Merge replication checks subscriber validation expressions to address an elevation of privilege flaw.³¹
  Fixes an elevation of privilege vulnerability in merge replication by improving validation of subscriber validation expressions.

For: All platforms

• Querying a corrupted row-compressed record no longer exposes unintended memory content; SQL Server reports database corruption.¹⁸
  Validates compressed-record metadata when querying a corrupted row-compressed record and returns a database corruption error.

For: Windows

• Reading malformed COLUMNSTORE_ARCHIVE-compressed segments no longer causes a heap buffer overflow.¹⁹
  Fixes a heap buffer overflow when SQL Server reads COLUMNSTORE_ARCHIVE-compressed segments with malformed compression block headers.

For: All platforms

• Some window-aggregate queries return correct results when a partitioning column uses a case-insensitive collation.²²
  Fixes incorrect results for a string predicate over a window aggregate when the partitioning column uses a case-insensitive collation.

For: Windows Integration Services users

• Truncated OLE DB output parameters no longer cause invalid memory access in the Execute SQL Task.²³
  Fixes invalid memory access when handling truncated OLE DB output parameters in the Integration Services Execute SQL Task.
• An integer overflow in the Integration Services HTTP Connection Manager no longer causes invalid memory access.²⁴
  Fixes an integer overflow in the Integration Services HTTP Connection Manager that can cause invalid memory access.
• The Integration Services Raw File source is less likely to cause a memory access violation while reading data.²⁶
  Fixes a memory access violation that might occur when the Raw File source component reads data.

• PolyBase checks data more carefully to address a security vulnerability.³²
  Addresses a PolyBase security vulnerability by improving data validation.
• Shared memory region counts are checked to help prevent race conditions during cleanup.⁴¹
  Improves validation of shared memory region counts to prevent race conditions during shared memory cleanup.
• PolyBase checks Delta table schemas more carefully.⁴²
  Improves validation of Delta table schemas.
• The sys.sp_polybase_show_objects procedure checks input more carefully.⁸³
  Improves input validation in the sys.sp_polybase_show_objects stored procedure.

For: All platforms

• The archive extraction component used to install external language and library packages is updated.³³
  Updates a component used to extract archives when installing external language and external library packages.

For: All platforms

• Availability-group secondary replicas reject oversized FILESTREAM fragments.³⁴
  Adds validation of FILESTREAM fragment sizes on availability group secondary replicas.

For: Windows

• Showplan processing checks input more carefully for better security and reliability.³⁵
  Improves input validation in Showplan processing.

• Internal replication data receives better protection during processing.³⁶
  Improves protection of internal replication data during processing.
• Merge replication handles text data more safely and reliably.³⁷
  Improves handling of text data in merge replication.
• Replication operations receive better validation and handling for improved security and reliability.³⁸
  Improves validation and handling of replication operations.
• Queued updating subscriptions in transactional replication receive better security and reliability checks.³⁹
  Improves security and reliability of queued updating subscriptions in transactional replication.
• Queued updating subscriptions in transactional replication receive better security and reliability checks.⁴⁰
  Improves security and reliability of queued updating subscriptions in transactional replication.
• Merge replication checks identifiers more carefully.⁴³
  Improves identifier validation in merge replication.
• Transactional replication checks identifiers more carefully.⁴⁵
  Improves identifier validation in transactional replication.
• Replication security metadata is handled more safely when subscriber databases are restored or upgraded.⁵⁴
  Improves security and reliability of replication security metadata handling during subscriber database restore and upgrade operations.
• The Log Reader Agent is more secure and reliable in heterogeneous transactional replication.⁵⁵
  Improves security and reliability of the Log Reader Agent in heterogeneous transactional replication scenarios.
• Change feed configuration receives better security and reliability checks.⁵⁶
  Improves security and reliability of change feed configuration.
• Merge replication checks retry-list bounds more carefully.⁵⁷
  Improves bounds validation when merge replication processes retry lists.
• Replication checks data more carefully during encryption operations.⁵⁸
  Improves data validation during replication encryption operations.
• Merge replication checks data more carefully during web synchronization.⁵⁹
  Improves data validation during merge replication web synchronization.
• Authorization checks for replication performance counters are improved.⁶⁰
  Improves authorization checks for replication performance counter operations.
• Merge replication checks and handles operation metadata more carefully.⁶¹
  Improves validation and handling of metadata in merge replication operations.
• Replication transaction identifiers receive better bounds checks and Unicode conversion.⁶³
  Improves bounds validation and Unicode conversion when processing replication transaction identifiers.
• Replication checks UTF-16 terminators more safely during numeric conversion.⁶⁴
  Improves bounds validation to prevent out-of-bounds memory reads when SQL Server scans UTF-16 terminators during replication numeric conversion.
• Replication database upgrades receive stronger security checks.⁶⁷
  Improves security validation during replication database upgrades.
• Transactional replication checks conflict table names more carefully.⁶⁸
  Improves conflict table name validation in transactional replication.
• The Replication Queue Reader Agent checks its parameters more carefully.⁶⁹
  Improves parameter validation in the Replication Queue Reader Agent.
• Merge replication handles conflict table names more carefully.⁷⁰
  Improves conflict table name handling in merge replication.
• Merge replication checks security when reporting conflicts.⁷¹
  Improves security validation for merge replication conflict reporting.
• Merge replication checks object names more carefully during schema changes.⁷²
  Improves object name validation for merge replication schema changes.
• Generated merge replication procedures handle table names more carefully.⁷³
  Improves table name handling in generated merge replication procedures.
• SQL Server checks input more carefully when processing merge replication changes.⁷⁴
  Improves input validation when SQL Server processes merge replication changes.
• SQL Server handles schema changes in transactional replication more securely.⁷⁵
  Improves security when SQL Server processes schema changes in transactional replication.
• Lightweight merge replication operations receive better security checks.⁷⁶
  Improves security checks for lightweight merge replication operations.
• Queued replication data receives better security checks.⁷⁷
  Improves security validation when SQL Server processes queued replication data.
• Replication subscription checks validate roles more carefully.⁷⁹
  Improves role validation during replication subscription checks.
• Replication data and operations receive stronger security checks.⁸¹
  Improves security for replication data and operations.
• The Replication Queue Reader Agent checks bounds when it processes queued update messages.⁸²
  Improves bounds validation when the Replication Queue Reader Agent processes queued update messages.
• The Replication Queue Reader Agent checks parameters and handles data conversion more carefully.⁸⁴
  Improves parameter validation and data conversion handling in the Replication Queue Reader Agent.
• Replication metadata checks help prevent invalid rowset binding access.⁸⁵
  Improves replication metadata validation to prevent invalid rowset binding access.
• Replication linked-server access receives better security checks.⁸⁶
  Improves security checks for replication linked-server access.
• Azure Synapse Link for SQL checks input more carefully.⁸⁷
  Improves input validation in Azure Synapse Link for SQL.
• Merge replication checks error sources more carefully to address a security vulnerability.⁸⁸
  Improves error-source validation in merge replication to handle a security vulnerability.

For: All platforms

• XA stored procedures check output buffers; undersized buffers now return error 47204.⁴⁴
  Improves output-buffer validation in XA stored procedures; undersized output buffers return error 47204.

For: Windows

• Transaction log blocks are checked to help prevent out-of-bounds reads when scanning malformed records.⁴⁶
  Improves validation of transaction log blocks during recovery and log scanning.

For: Windows

• Buffers used when building index records and splitting B-tree pages are initialized for better security.⁴⁷
  Improves security by initializing buffers used during index record construction and B-tree page splits.
• Buffers used during storage engine data changes and record reconstruction are initialized for better security.⁴⁸
  Improves security by initializing buffers used during storage engine insert, update, bulk, compression, and record reconstruction operations.
• Malformed long-column offsets in page-compressed records are rejected.⁴⁹
  Improves validation of long-column offsets in page-compressed records.
• Sparse-column record headers and offsets are checked more carefully when records are read or rebuilt.⁵⁰
  Improves validation of sparse-column record headers and column offsets when SQL Server reads or rebuilds records.
• Variable-length column offsets are checked more carefully when SQL Server processes database records.⁵²
  Improves validation of variable-length column offsets during database record processing.
• Column metadata checks help prevent out-of-bounds writes when SQL Server loads database schemas.⁵³
  Improves column metadata validation to prevent out-of-bounds memory writes when SQL Server loads database schemas.

For: Windows

• Columnstore header sizes are checked when SQL Server attaches, restores, or checks a database.⁵¹
  Improves validation of columnstore header sizes during database attach, restore, or check operations.

For: All platforms

• Malformed trace data is checked more safely when the SQL Trace reader processes login security identifiers.⁶²
  Improves validation of login security identifier (SID) data to prevent out-of-bounds memory reads when the SQL Trace reader processes malformed trace data.

• Internal stored procedures check object names while keeping their existing behavior.⁶⁵
  Improves object name validation in internal stored procedures while preserving existing behavior.
• SQL Server Agent job steps receive better authorization checks.⁷⁸
  Improves authorization validation for SQL Server Agent job steps.

For: Windows

• SQLDiag handles long and Unicode database names more reliably when collecting diagnostics.⁶⁶
  Improves SQLDiag handling of database names, including long names and Unicode characters, for diagnostic collection reliability and security.

For: Windows Integration Services users

• XSLT scripting is disabled by default in the Integration Services XML Task. Set EnableXsltScript to 1 to restore the previous behavior.⁸⁰
  Disables Extensible Stylesheet Language Transformations (XSLT) scripting by default in the SQL Server Integration Services XML Task. The value is under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server{version}\SSIS\XMLTask.

For: All platforms

• Trace flag 697 can disable HoBt schema-latch promotion without disabling all superlatching.⁸⁹
  Adds trace flag 697 to disable heap or B-tree (HoBt) schema-latch promotion to superlatches for workloads with high CPU use and latch contention.
• Trace flag 683 can reduce CPU overhead when latch promotion occurs without counter partitioning.⁹⁰
  Adds trace flag 683 to reduce CPU overhead when heap or B-tree (HoBt) latches are promoted to superlatches but counter partitioning doesn't occur.

For: All platforms using Azure SQL Managed Instance multi-database link mode

• Three procedures can restart seeding, repair a broken link, and check database health in multi-database link mode with Azure SQL Managed Instance.⁹¹
  Adds sys.sp_milink_reseed, sys.sp_milink_repair, and sys.sp_milink_check for databases in multi-database link mode with Azure SQL Managed Instance.