Skip to the content
The Update Bureau
SQL Server 2022 CU27 + GDR SQL Server 2022 CU27 + GDR Security update
Patch Tuesday

KB5126934

KB5126934: Security update for SQL Server 2022, CU branch, October 2026. Recovery queries may raise access violations; security flaws fixed

In short

Security fixes cover SQL Server components. Queries against sys.dm_exec_requests during database recovery might raise an access violation and create a dump file.

Does it affect you? Applies to: SQL Server 2022 instances on Windows or Linux, including releases through CU27 GDR. The Windows package is for x64 systems; Linux systems use the CU repository.

Build
16.0.4305.5
Servicing branch
CU
Security
23 fixed
Restart
Required
Review notes Additional details from the official release notes (2) Read notes
  • What changes The backup and restore metadata issue could let a local authenticated user gain elevated privileges or cause a service to stop responding.
  • What changes The backup and restore metadata issue could let a local authenticated user gain elevated privileges or cause a service to stop responding.

The official sources are linked at the end of the page.

For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?

What changes

Fixes 12 changes

Extended Events

  • A specially crafted Extended Events file could expose information or cause a denial of service when the Database Engine read it. This is fixed.1
    Fixes several vulnerabilities triggered when the Database Engine reads a specially crafted Extended Events (.xel) file.

Backup Restore

3 items
  • A backup and restore metadata issue could let a local authenticated user gain elevated privileges or stop a service. The update adds checks for malformed or oversized inputs.2
    Adds strict bounds validation and safe size calculation checks before memory operations in SQL Server backup and restore metadata processing.
  • A security flaw in the Virtual Device Interface could cause an out-of-bounds write while opening a virtual device set. This is fixed.4
    Fixes an out-of-bounds write vulnerability in the SQL Server Virtual Device Interface (VDI) when opening a virtual device set.
  • A security flaw in the Virtual Device Interface could cause an out-of-bounds read or write during backup or restore. This is fixed.5
    Fixes an out-of-bounds read or write vulnerability while processing transferred data during VDI backup or restore operations.

PolyBase

3 items
  • The SQL Server process could stop unexpectedly while working with external data sources. This is fixed.3
    Addresses an issue that causes the SQL Server process to terminate unexpectedly while working with external data sources.
  • A PolyBase security flaw is addressed with better checks during data processing.6
    Resolves a security vulnerability in PolyBase by improving validation during data processing.
  • Malformed PolyBase rollback data is now rejected instead of being read unsafely.7
    Fixes unsafe deserialization of PolyBase rollback queue data so that malformed payloads are rejected.

Extensibility

  • Security flaws in SQL Satellite message handling could cause memory corruption or expose memory. These flaws are fixed.8
    Fixes multiple memory-corruption and memory-disclosure vulnerabilities in SQL Server's SQL Satellite protocol message parsing logic used by Machine Learning Services and Language Extensions.

Distributed Query

  • MSDASQL-linked server connections work when the provider string does not include a user ID.9
    Fixes MSDASQL-linked server connections that fail if the provider string does not include a user ID (UID).

Replication

3 items
  • Merge replication no longer has the listed buffer overflow when it processes more than 250 WebSync XML nickname entries.10
    Fixes a buffer overflow that occurs if merge replication processes more than 250 WebSync XML nickname entries.
  • A data validation issue in replication operations is fixed.11
    Fixes an issue in replication operations that affects data validation.
  • A data validation issue in merge replication Web Synchronization is fixed.12
    Fixes an issue in merge replication Web Synchronization operations that affects data validation.

Improvements 11 changes

High Availability and Disaster Recovery

  • Availability Group secondary replicas now reject oversized FILESTREAM fragments.13
    Adds validation of FILESTREAM fragment size on Availability Group secondary replicas.

Backup Restore

2 items
  • Invalid size values in backup paths are checked before they can cause unsafe memory access.14
    Adds hardened arithmetic and transfer-sized validation to reject invalid requests in SQL Server Virtual Device Interface and SQL Writer backup paths.
  • A backup and restore metadata issue could let a local authenticated user gain elevated privileges or stop a service. The update adds checks for malformed or oversized inputs.15
    Adds strict bounds validation and safe size calculation checks before memory operations in SQL Server backup and restore metadata processing.

PolyBase

2 items
  • PolyBase now checks delta table schemas.16
    Adds validation for delta table schema.
  • PolyBase shared memory handling is updated.17
    Updates shared memory handling.

Extensibility

  • SQL Server uses an updated archive-extraction component when external language and external library packages are installed.18
    Updates the third-party archive-extraction component used by SQL Server when external language and external library packages are installed.

Replication

4 items
  • Replication security metadata handling is more secure and reliable when a Subscriber database is restored or upgraded.19
    Improves security and reliability in replication security metadata handling during Subscriber database restore and upgrade.
  • The Log Reader Agent is more secure and reliable in heterogeneous transactional replication.20
    Improves security and reliability for the Log Reader Agent in a heterogeneous transactional replication scenario.
  • Change feed configuration is more secure and reliable.21
    Improves security and reliability for the change feed configuration.
  • Stronger checks help prevent certain replication database operations from exposing database information.22
    Strengthens authorization checks for certain replication-related database operations to prevent unintended disclosure of database information.

Programmability

  • SQL Trace reader processing now limits LoginSid data to the internal buffer size, preventing malformed trace data from causing an out-of-bounds read.23
    Limits LoginSid processing within the SQL Trace reader to the internal buffer size to prevent malformed trace data from causing an out-of-bounds read action.

Known issues

  1. Open Affects: Everyone

    Linked server queries that use MSDASQL fail with error 7416

    Linked server queries that use the MSDASQL provider and specify a provider string (@provstr) might fail with error 7416.24

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  2. Open Affects: Everyone

    Access violation when you query sys.dm_exec_requests during database recovery

    Queries against sys.dm_exec_requests might raise an access violation and generate a dump file while a database is recovering.25

    How to apply the workaround SQL Trace Flag

    Enable trace flag 4696, avoid querying sys.dm_exec_requests for databases that are recovering, or uninstall the update. The trace flag might make monitoring queries on secondary replicas return error 976 or 978.25

    Step-by-step workaround instructions
    2 steps
    Show steps Hide steps
    Step-by-step procedure
    1. Enable trace flag 4696 to opt out of the code change.
    2. Alternatively, avoid querying sys.dm_exec_requests for databases that are recovering, or uninstall the update.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-10-13
Classification
Security Updates
Type
Cumulative update
Servicing branch
CU
Restart
Required
Replaces
KB5104824, KB5122768, KB5093420, KB5101347
+29 earlier KB5081477, KB5089900, KB5083252, KB5080999, KB5077464, KB5078297, KB5072936, KB5068450, KB5068406, KB5065865, KB5065220, KB5063814, KB5059390, KB5058721, KB5054531, KB5050771, KB5048038, KB5048033, KB5046862, KB5046059, KB5041321, KB5042578, KB5038325, KB5040939, KB5036432, KB5036343, KB5033663, KB5032679, KB5033592
Replaced by
KB5129300
VersionBuildChannel
2022 16.0.4305.5 General availability

Security

23 vulnerabilities fixed
18 important 5 not rated
VulnerabilitySeverityCVSS
CVE-2026-32176
SQL Server Elevation of Privilege Vulnerability
 Important —
CVE-2026-65674
Microsoft SQL Server Remote Code Execution Vulnerability
 Important —
CVE-2026-67625
Microsoft SQL Server Remote Code Execution Vulnerability
 Important —
CVE-2026-67626
Microsoft SQL Server Denial of Service Vulnerability
 Important —
CVE-2026-67628
Microsoft SQL Server Information Disclosure Vulnerability
 Important —
CVE-2026-67645
Microsoft SQL Server Information Disclosure Vulnerability
 Important —
CVE-2026-68883
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important —
CVE-2026-70189
Microsoft SQL Server Remote Code Execution Vulnerability
 Important —
CVE-2026-85876
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important —
CVE-2026-85886
Microsoft SQL Server Remote Code Execution Vulnerability
 Important —
CVE-2026-85888
Microsoft SQL Server Information Disclosure Vulnerability
 Important —
CVE-2026-85919
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important —
CVE-2026-88081
Microsoft SQL Server Information Disclosure Vulnerability
 Important —
CVE-2026-88082
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important —
CVE-2026-88083
Microsoft SQL Server Remote Code Execution Vulnerability
 Important —
CVE-2026-88085
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important —
CVE-2026-88086
Microsoft SQL Server Information Disclosure Vulnerability
 Important —
CVE-2026-88088
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important —
CVE-2026-83945
Microsoft SQL Server Remote Code Execution Vulnerability
 Not rated —
CVE-2026-88089
Microsoft SQL Server Remote Code Execution Vulnerability
 Not rated —
CVE-2026-94512
SQL Server Remote Code Execution Vulnerability
 Not rated —
CVE-2026-94520
Microsoft SQL Server Denial of Service Vulnerability
 Not rated —
CVE-2026-96956
SQL Server Elevation of Privilege Vulnerability
 Not rated —

Downloads (Microsoft Update Catalog)

Package 2022
468.3 MB
sqlserver2022-kb5126934-x64.exe Main update · KB5126934 SHA-1: 01742bd8…dd8af0

Updated components

147 files changed since the previous update for the same versions.

Top changed componentsFiles
SQL Server Engine115
SQL Server PolyBase3

Page history

  1. Superseded by KB5129300

    Removed CVE-2026-83945

    Removed CVE-2026-88089

    Removed CVE-2026-94512

    Removed CVE-2026-94520

    Removed CVE-2026-96956

    Added CVE-2026-67645 (Important)

Sources

Updated
Cited passages from Microsoft's official notes (25)
  1. 1. Fixes several security vulnerabilities that allow information disclosure or a denial of service when the Database Engine reads a specially crafted Extended Events (.xel) file. support.microsoft.com
  2. 2. Addresses an integer handling issue in SQL Server backup and restore metadata processing that potentially allows a local authenticated user to gain elevated privileges and cause a service to stop responding. support.microsoft.com
  3. 3. Addresses an issue that causes the SQL Server process to terminate unexpectedly while working with external data sources. support.microsoft.com
  4. 4. Fixes a security vulnerability in the SQL Server Virtual Device Interface (VDI) in which an out-of-bounds write action potentially occurs while opening a virtual device set. support.microsoft.com
  5. 5. Fixes a security vulnerability in the SQL Server Virtual Device Interface (VDI) in which an out-of-bounds read or write action potentially occurs while processing transferred data during backup or restore operations. support.microsoft.com
  6. 6. Resolves a security vulnerability in PolyBase by improving validation during data processing. support.microsoft.com
  7. 7. Fixes unsafe deserialization of PolyBase rollback queue data so that malformed payloads are rejected. support.microsoft.com
  8. 8. Fixes multiple memory-corruption and memory-disclosure vulnerabilities in SQL Server's SQL Satellite protocol message parsing logic that's used by Machine Learning Services and Language Extensions. support.microsoft.com
  9. 9. Fixes an issue in which MSDASQL-linked server connections fail if the provider string does not include a user ID (UID). support.microsoft.com
  10. 10. Fixes a buffer overflow that occurs if merge replication processes more than 250 WebSync XML nickname entries. support.microsoft.com
  11. 11. Fixes an issue in replication operations that affects data validation. support.microsoft.com
  12. 12. Fixes an issue in merge replication Web Synchronization operations that affects data validation. support.microsoft.com
  13. 13. Adds validation of FILESTREAM fragment size on Availability Group secondary replicas to reject oversized fragments. support.microsoft.com
  14. 14. Addresses an input-validation issue in SQL Server Virtual Device Interface (VDI) and SQL Writer backup paths in which malformed size values potentially cause out-of-bounds memory access. support.microsoft.com
  15. 15. Addresses an integer handling issue in SQL Server backup and restore metadata processing that potentially allows a local authenticated user to gain elevated privileges and cause a service to stop responding. support.microsoft.com
  16. 16. Adds validation for delta table schema. support.microsoft.com
  17. 17. Updates shared memory handling. support.microsoft.com
  18. 18. Updates the third-party archive-extraction component that SQL Server uses if external language and external library packages are installed. support.microsoft.com
  19. 19. Improves security and reliability in replication security metadata handling during Subscriber database restore and upgrade. support.microsoft.com
  20. 20. Improves security and reliability for the Log Reader Agent in a heterogeneous transactional replication scenario. support.microsoft.com
  21. 21. Improves security and reliability for the change feed configuration. support.microsoft.com
  22. 22. Strengthens authorization checks for certain replication-related database operations to prevent unintended disclosure of database information. support.microsoft.com
  23. 23. Limits LoginSid processing within the SQL Trace reader to the internal buffer size to prevent malformed trace data from causing an out-of-bounds read action. support.microsoft.com
  24. 24. Linked server queries that use the MSDASQL (OLE DB Provider for ODBC Drivers) provider and specify a provider string (@provstr) fail and return the following error message: support.microsoft.com
  25. 25. Queries against sys.dm_exec_requests might raise an access violation and generate a dump file if they run while a database is still recovering. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 25 quoted passages · compared with Microsoft's page on Nov 14, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake