KB5128493: Security update for SQL Server 2022, GDR branch, October 2026. PolyBase security flaws addressed; linked server queries can fail

For: Linux and Windows

• Package extraction uses an updated archive-extraction component when external language or external library packages are installed.¹
  Updates the third-party archive-extraction component that SQL Server uses if external language and external library packages are installed.

For: Linux and Windows

• Oversized FILESTREAM fragments are rejected on Availability Group secondary replicas.²
  Adds validation of FILESTREAM fragment size on Availability Group secondary replicas to reject oversized fragments.

For: Windows

• Showplan input handling is improved for security and reliability.³
  Improves Showplan input handling to enhance security and reliability.

• Queued Updating Subscriptions get security and reliability improvements.⁴
  Improves security and reliability for Queued Updating Subscriptions in Transactional Replication.
• Queued Updating Subscriptions get security and reliability improvements.⁵
  Improves security and reliability for Queued Updating Subscriptions in Transactional Replication.
• Replication security metadata handling is improved during Subscriber database restore and upgrade operations.⁸
  Improves security and reliability in replication security metadata handling during Subscriber database restore and upgrade operations.
• The Log Reader Agent gets security and reliability improvements for heterogeneous transactional replication.⁹
  Improves security and reliability for the Log Reader Agent in a heterogeneous transactional replication scenario.
• Change feed configuration gets security and reliability improvements.¹⁰
  Improves security and reliability for the change feed configuration.
• Authorization checks are strengthened for certain replication-related database operations to help prevent unintended disclosure of database information.¹¹
  Strengthens authorization checks for certain replication-related database operations to prevent unintended disclosure of database information.

For: Linux and Windows

• Shared memory handling is updated.⁶
  Updates shared memory handling.
• PolyBase validates delta table schemas.⁷
  Adds validation for delta table schema.

For: Linux and Windows

• LoginSid processing is limited to the internal buffer size to help prevent malformed trace data from causing an out-of-bounds read.¹²
  Limits LoginSid processing within the SQL Trace reader to the internal buffer size to prevent malformed trace data from causing an out-of-bounds read.

For: Linux and Windows

• PolyBase data processing gets improved validation to address a security vulnerability.¹³
  Improves validation during data processing.
• An issue that could make the SQL Server process terminate while working with external data sources is addressed.¹⁴
  Addresses an issue that causes the SQL Server process to terminate unexpectedly while working with external data sources.
• Malformed PolyBase rollback queue data is rejected instead of being unsafely deserialized.¹⁹
  Fixes unsafe deserialization of PolyBase rollback queue data so that malformed payloads are rejected.

For: Windows

• Invalid size values in certain backup paths are rejected before they can cause unsafe memory access.¹⁵
  Addresses an input-validation issue in SQL Server Virtual Device Interface (VDI) and SQL Writer backup paths in which malformed size values potentially cause out-of-bounds memory access.
• Malformed or oversized backup and restore metadata inputs are rejected before memory operations. This addresses a problem that could let a local authenticated user gain elevated privileges or make a service stop responding.¹⁶
  Addresses an integer handling issue in SQL Server backup and restore metadata processing that potentially allows a local authenticated user to gain elevated privileges and cause a service to stop responding.
• A security vulnerability that could cause an out-of-bounds write while opening a virtual device set is fixed.¹⁷
  Fixes a security vulnerability in the SQL Server Virtual Device Interface (VDI) in which an out-of-bounds write action potentially occurs while opening a virtual device set.
• A security vulnerability that could cause an out-of-bounds read or write during backup or restore data transfer is fixed.¹⁸
  Fixes a security vulnerability in the SQL Server Virtual Device Interface (VDI) in which an out-of-bounds read or write action potentially occurs while processing transferred data during backup or restore operations.

For: Linux and Windows

• Memory-corruption and memory-disclosure vulnerabilities in SQL Satellite message processing are fixed.²⁰
  Fixes multiple memory-corruption and memory-disclosure vulnerabilities in SQL Server's SQL Satellite protocol message parsing logic that's used by Machine Learning Services and Language Extensions.

For: Linux and Windows

• An MSDASQL-linked server connection issue is fixed when its provider string does not include a user ID.²¹
  Fixes an issue in which MSDASQL-linked server connections fail if the provider string does not include a user ID (UID).

For: Linux and Windows

• A buffer overflow that could occur when merge replication processes more than 250 WebSync XML nickname entries is fixed.²²
  Fixes a buffer overflow that occurs if merge replication processes more than 250 WebSync XML nickname entries.
• An issue affecting data validation in replication operations is fixed.²³
  Fixes an issue in replication operations that affects data validation.
• An issue affecting data validation in merge replication Web Synchronization operations is fixed.²⁴
  Fixes an issue in merge replication Web Synchronization operations that affects data validation.