Skip to the content
The Update Bureau
SQL Server 2025 GDR SQL Server 2025 GDR Security update
Patch Tuesday

KB5128492

KB5128492: Security update for SQL Server 2025, GDR branch, October 2026. 23 SQL vulnerabilities addressed; MSDASQL linked queries still fail

In short

Addresses 23 SQL Server vulnerabilities, including 22 rated Important. Linked server queries using MSDASQL can still fail with error 7416 in some configurations.

Does it affect you? Applies to: SQL Server 2025 on Windows and Linux, all editions. The package is for x64 systems.

Build
17.0.1145.4
Servicing branch
GDR
Security
23 fixed
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • What changes This update fixes a failure involving provider strings without a user ID, but some linked-server queries using MSDASQL and a provider string can still fail with error 7416.

The official sources are linked at the end of the page.

For servers on the GDR branch: they get security fixes only. Servers that install cumulative updates (CU branch) get a separate update. Which branch am I on?

What changes

Fixes 15 changes

PolyBase

3 items
  • PolyBase validates data processing more carefully to address a security vulnerability.1
    Applies to Linux and Windows.
  • The SQL Server process no longer terminates unexpectedly while working with external data sources.2
    Applies to Linux and Windows.
  • PolyBase rejects malformed rollback queue data.9
    Fixes unsafe deserialization of PolyBase rollback queue data. Applies to Linux and Windows.

Backup Restore

4 items
  • Invalid size values in backup paths are rejected before they can cause unsafe memory access.3
    Addresses input validation in SQL Server Virtual Device Interface (VDI) and SQL Writer backup paths. Windows only.
  • Malformed or oversized backup and restore metadata is rejected to address a privilege-escalation and service-stoppage risk.4
    Adds bounds validation and safe size calculations during metadata processing. Windows only.
  • The Virtual Device Interface addresses a security vulnerability that could cause an out-of-bounds write when opening a virtual device set.6
    Windows only.
  • The Virtual Device Interface addresses a security vulnerability involving transferred data during backup or restore.7
    Fixes a potential out-of-bounds read or write while processing transferred data. Windows only.

Extended Events

  • The Database Engine addresses security vulnerabilities that could expose information or cause a denial of service when reading a specially crafted Extended Events file.5
    Applies to Linux and Windows.

Extensibility

2 items
  • SQL Server addresses a vulnerability involving invalid memory reads when processing AI-generated embeddings.8
    Fixes invalid memory-read handling in the AI_GENERATE_EMBEDDINGS runtime parameter. Applies to Linux and Windows.
  • SQL Server addresses memory-corruption and memory-disclosure vulnerabilities in messages used by Machine Learning Services and Language Extensions.10
    The issue is in SQL Satellite protocol message parsing. Applies to Linux and Windows.

Distributed Query

  • MSDASQL-linked server connections work when the provider string does not include a user ID.11
    Applies to Linux and Windows.

Replication

4 items
  • Merge replication avoids a buffer overflow when processing more than 250 WebSync XML nickname entries.12
    Applies to Linux and Windows.
  • A data-validation problem in replication operations is fixed.13
    Applies to Linux and Windows.
  • A data-validation problem in merge replication Web Synchronization operations is fixed.14
    Applies to Linux and Windows.
  • An issue processing input data for change event streaming is fixed.15
    Applies to Linux and Windows.

Improvements 12 changes

Extensibility

  • Package extraction uses an updated archive-extraction component when external language or external library packages are installed.16
    Applies to Linux and Windows.

High Availability and Disaster Recovery

  • Availability Group secondary replicas reject oversized FILESTREAM fragments.17
    Adds validation of FILESTREAM fragment size. Applies to Linux and Windows.

Query Store

  • Showplan input handling is more secure and reliable.18
    Windows only.

Replication

6 items
  • Queued Updating Subscriptions in Transactional Replication receive security and reliability improvements.19
    Windows only.
  • Queued Updating Subscriptions in Transactional Replication receive security and reliability improvements.20
    Windows only.
  • Replication security metadata handling is more secure and reliable during Subscriber database restore and upgrade.23
    Windows only.
  • The Log Reader Agent is more secure and reliable in heterogeneous transactional replication scenarios.24
    Windows only.
  • Change feed configuration handling is more secure and reliable.25
    Windows only.
  • Authorization checks help prevent unintended disclosure of database information during certain replication-related operations.26
    Applies to Linux and Windows.

PolyBase

2 items
  • PolyBase validates delta table schemas.21
    Applies to Linux and Windows.
  • PolyBase shared memory handling is updated.22
    Applies to Linux and Windows.

Programmability

  • SQL Trace reader processing is limited to its internal buffer size to help prevent malformed trace data from causing an out-of-bounds read.27
    Applies to Linux and Windows.

Known issues

  1. Open Affects: Organizations and IT administrators

    Linked server queries that use MSDASQL fail with error 7416

    Linked server queries that use the MSDASQL provider and specify a provider string (@provstr) might fail with error 7416, saying that no login mapping exists. A stricter Database Engine connection check can reject some configurations that worked in earlier builds.28

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-10-13
Classification
Security Updates
Type
Cumulative update
Servicing branch
GDR
Restart
Required
Replaces
KB5122770, KB5102333, KB5091223, KB5084814
+2 earlier KB5077468, KB5073177
Replaced by
KB5132748
VersionBuildChannel
2025 17.0.1145.4 General availability

Security

23 vulnerabilities fixed
17 important 6 not rated
VulnerabilitySeverityCVSS
CVE-2026-65674
Microsoft SQL Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-67625
Microsoft SQL Server Remote Code Execution Vulnerability
 Important 8.5
CVE-2026-68883
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 8.5
CVE-2026-85886
Microsoft SQL Server Remote Code Execution Vulnerability
 Important 8.5
CVE-2026-85888
Microsoft SQL Server Information Disclosure Vulnerability
 Important 7.7
CVE-2026-88081
Microsoft SQL Server Information Disclosure Vulnerability
 Important 7.7
CVE-2026-88083
Microsoft SQL Server Remote Code Execution Vulnerability
 Important 7.5
CVE-2026-85876
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 7.0
CVE-2026-85919
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 7.0
CVE-2026-88082
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 7.0
CVE-2026-88088
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 7.0
CVE-2026-32176
SQL Server Elevation of Privilege Vulnerability
 Important 6.7
CVE-2026-70189
Microsoft SQL Server Remote Code Execution Vulnerability
 Important 6.7
CVE-2026-67626
Microsoft SQL Server Denial of Service Vulnerability
 Important 6.5
CVE-2026-88085
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important 6.4
CVE-2026-88086
Microsoft SQL Server Information Disclosure Vulnerability
 Important 5.3
CVE-2026-67628
Microsoft SQL Server Information Disclosure Vulnerability
 Important 4.9
CVE-2026-83945
Microsoft SQL Server Remote Code Execution Vulnerability
 Not rated —
CVE-2026-88089
Microsoft SQL Server Remote Code Execution Vulnerability
 Not rated —
CVE-2026-94512
SQL Server Remote Code Execution Vulnerability
 Not rated —
CVE-2026-94520
Microsoft SQL Server Denial of Service Vulnerability
 Not rated —
CVE-2026-94530
Not rated —
CVE-2026-96956
SQL Server Elevation of Privilege Vulnerability
 Not rated —

Downloads (Microsoft Update Catalog)

Package 2025
346.9 MB
sqlserver2025-kb5128492-x64.exe Main update · KB5128492 SHA-1: 6f886aca…b65731

Updated components

143 files changed since the previous update for the same versions.

Top changed componentsFiles
SQL Server Engine114
SQL Server PolyBase3

Page history

  1. Superseded by KB5132748

    Removed CVE-2026-83945

    Removed CVE-2026-88089

    Removed CVE-2026-94512

    Removed CVE-2026-94520

    Removed CVE-2026-96956

Sources

Updated
Cited passages from Microsoft's official notes (28)
  1. 1. Resolves a security vulnerability in PolyBase by improving validation during data processing. support.microsoft.com
  2. 2. Addresses an issue that causes the SQL Server process to terminate unexpectedly while working with external data sources. support.microsoft.com
  3. 3. Addresses an input-validation issue in SQL Server Virtual Device Interface (VDI) and SQL Writer backup paths in which malformed size values potentially lead to out-of-bounds memory access. support.microsoft.com
  4. 4. Addresses an integer handling issue in SQL Server backup and restore metadata processing that potentially allows a local authenticated user to gain elevated privileges and cause a service to stop responding. support.microsoft.com
  5. 5. Fixes several security vulnerabilities that allow information disclosure or a denial of service when the Database Engine reads a specially crafted Extended Events (.xel) file. support.microsoft.com
  6. 6. Fixes a security vulnerability in the SQL Server Virtual Device Interface (VDI) in which an out-of-bounds write action potentially occurs while opening a virtual device set. support.microsoft.com
  7. 7. Fixes a security vulnerability in the SQL Server Virtual Device Interface (VDI) in which an out-of-bounds read or write action potentially occurs while processing transferred data during backup or restore operations. support.microsoft.com
  8. 8. Fixes invalid memory-read vulnerability in SQL Server's AI_GENERATE_EMBEDDINGS runtime parameter processing. support.microsoft.com
  9. 9. Fixes unsafe deserialization of PolyBase rollback queue data so that malformed payloads are rejected. support.microsoft.com
  10. 10. Fixes multiple memory-corruption and memory-disclosure vulnerabilities in SQL Server's SQL Satellite protocol message parsing logic that's used by Machine Learning Services and Language Extensions. support.microsoft.com
  11. 11. Fixes an issue in which MSDASQL-linked server connections fail if the provider string does not include a user ID (UID). support.microsoft.com
  12. 12. Fixes a buffer overflow that occurs if merge replication processes more than 250 WebSync XML nickname entries. support.microsoft.com
  13. 13. Fixes an issue in replication operations that affects data validation. support.microsoft.com
  14. 14. Fixes an issue in merge replication Web Synchronization operations that affects data validation. support.microsoft.com
  15. 15. Fixes an issue in input data processing for change event streaming. support.microsoft.com
  16. 16. Updates the third-party archive-extraction component that SQL Server uses if external language and external library packages are installed. support.microsoft.com
  17. 17. Adds validation of FILESTREAM fragment size on Availability Group secondary replicas to reject oversized fragments. support.microsoft.com
  18. 18. Improves Showplan input handling to enhance security and reliability. support.microsoft.com
  19. 19. Improves security and reliability for Queued Updating Subscriptions in Transactional Replication. support.microsoft.com
  20. 20. Improves security and reliability for Queued Updating Subscriptions in Transactional Replication. support.microsoft.com
  21. 21. Adds validation for delta table schema. support.microsoft.com
  22. 22. Updates shared memory handling. support.microsoft.com
  23. 23. Improves security and reliability in replication security metadata handling during Subscriber database restore and upgrade. support.microsoft.com
  24. 24. Improves security and reliability for the Log Reader Agent in a heterogeneous transactional replication scenario. support.microsoft.com
  25. 25. Improves security and reliability for the change feed configuration. support.microsoft.com
  26. 26. Strengthens authorization checks for certain replication-related database operations to prevent unintended disclosure of database information. support.microsoft.com
  27. 27. Limits LoginSid processing within the SQL Trace reader to the internal buffer size to prevent malformed trace data from causing an out-of-bounds read action. support.microsoft.com
  28. 28. Linked server queries that use the MSDASQL (OLE DB Provider for ODBC Drivers) provider and specify a provider string (@provstr) fail and return the following error message: support.microsoft.com
Checked automatically: 7 of 8 checks passed, 28 quoted passages · compared with Microsoft's page on Nov 14, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake