Skip to the content
The Update Bureau
SQL Server 2019 CU32 + GDR SQL Server 2019 CU32 + GDR Security update
Patch Tuesday

KB5128494

KB5128494: Security update for SQL Server 2019, CU branch, October 2026. Database Engine vulnerabilities fixed; MSDASQL queries can fail

In short

Fixes 21 vulnerabilities in SQL Server 2019. Linked-server queries using MSDASQL with a provider string can fail with error 7416.

Does it affect you? Applies to: SQL Server 2019 installations on Windows or Linux. You need SQL Server 2019 or a SQL Server 2019 CU release through CU32 GDR installed first.

Build
15.0.4500.2
Servicing branch
CU
Security
21 fixed
Restart
Required

For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?

What changes

Fixes 11 changes

PolyBase

2 items
  • PolyBase data processing gets additional validation to address a security vulnerability.1
    Resolves a security vulnerability in PolyBase by improving validation during data processing. Applies to Linux and Windows.
  • Malformed PolyBase rollback queue data is rejected.7
    Fixes unsafe deserialization of PolyBase rollback queue data. Applies to Linux and Windows.

Extensibility

  • Machine Learning Services and Language Extensions get fixes for vulnerabilities in SQL Satellite message parsing.2
    Fixes multiple memory-corruption and memory-disclosure vulnerabilities in SQL Satellite protocol message parsing. Applies to Linux and Windows.

Backup Restore

4 items
  • Malformed size values in backup paths are rejected before they can lead to unsafe memory handling.3
    Addresses input validation in Virtual Device Interface (VDI) and SQL Writer backup paths with hardened arithmetic and transfer-sized validation. Applies to Windows.
  • Malformed or oversized backup and restore metadata is rejected, addressing a potential local privilege and service availability problem.4
    Adds bounds validation and safe size calculations to backup and restore metadata processing.
  • A security vulnerability that could cause an out-of-bounds write while opening a virtual device set is fixed.5
    Fixes an out-of-bounds write vulnerability in the SQL Server Virtual Device Interface (VDI). Applies to Linux and Windows.
  • A security vulnerability involving out-of-bounds reads or writes during backup or restore data transfer is fixed.6
    Fixes an out-of-bounds read or write vulnerability in the SQL Server Virtual Device Interface (VDI). Applies to Linux and Windows.

Distributed Query

  • MSDASQL linked-server connections work when the provider string does not include a user ID.8
    Fixes an issue in MSDASQL linked-server connections when the provider string does not include a user ID (UID). Applies to Linux and Windows.

Replication

2 items
  • A data-validation issue in replication operations is fixed.9
    Fixes an issue in replication operations that affects data validation. Applies to Linux and Windows.
  • A data-validation issue in merge replication Web Synchronization is fixed.10
    Fixes an issue in merge replication Web Synchronization operations that affects data validation. Applies to Linux and Windows.

Extended Events

  • Reading a specially crafted Extended Events file no longer exposes the listed vulnerabilities that could disclose information or cause a denial of service.11
    Fixes several security vulnerabilities that allow information disclosure or denial of service when the Database Engine reads a specially crafted Extended Events (.xel) file. Applies to Linux and Windows.

Improvements 11 changes

Extensibility

  • Package extraction uses an updated component when external language or external library packages are installed.12
    Updates SQL Server’s third-party archive-extraction component. Applies to Linux and Windows.

High Availability and Disaster Recovery

  • Availability Group secondary replicas reject oversized FILESTREAM fragments.13
    Adds validation of FILESTREAM fragment size on Availability Group secondary replicas. Applies to Linux and Windows.

Replication

5 items
  • Queued Updating Subscriptions get security and reliability improvements.14
    Improves security and reliability for Queued Updating Subscriptions in Transactional Replication. Applies to Windows.
  • Queued Updating Subscriptions get security and reliability improvements.15
    Improves security and reliability for Queued Updating Subscriptions in Transactional Replication. Applies to Windows.
  • Authorization checks help prevent unintended disclosure of database information during certain replication-related operations.19
    Strengthens authorization checks for certain replication-related database operations. Applies to Linux and Windows.
  • Replication security metadata handling is improved during Subscriber database restore and upgrade operations.21
    Improves security and reliability in replication security metadata handling during Subscriber database restore and upgrade operations. Applies to Windows.
  • The Log Reader Agent gets security and reliability improvements for heterogeneous transactional replication.22
    Improves security and reliability for the Log Reader Agent in a heterogeneous transactional replication scenario. Applies to Windows.

Query Store

  • Showplan input handling gets security and reliability improvements.16
    Improves Showplan input handling. Applies to Windows.

PolyBase

2 items
  • PolyBase shared memory handling is updated.17
    Updates shared memory handling. Applies to Linux and Windows.
  • PolyBase Native Compare Strings is updated.18
    Updates Native Compare Strings. Applies to Windows.

Programmability

  • SQL Trace reader processing is limited to its internal buffer size to guard against malformed trace data.20
    Limits LoginSid processing within the SQL Trace reader to the internal buffer size to prevent an out-of-bounds read. Applies to Linux and Windows.

Known issues

  1. Open Affects: Organizations and IT administrators

    Linked server queries that use MSDASQL fail with error 7416

    Linked-server queries using the MSDASQL provider and specifying a provider string (@provstr) can fail with error 7416: access to the remote server is denied because no login mapping exists. Stricter Database Engine connection validation can reject some configurations that worked in earlier builds.23

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-10-13
Classification
Security Updates
Type
Cumulative update
Servicing branch
CU
Restart
Required
Replaces
KB5122772, KB5102335, KB5090407, KB5084816
+18 earlier KB5077469, KB5068404, KB5065222, KB5063757, KB5058722, KB5054833, KB5049296, KB5049235, KB5046860, KB5046365, KB5046060, KB5042749, KB5039747, KB5040948, KB5037331, KB5035123, KB5036335, KB5033688
Replaced by
KB5132745
VersionBuildChannel
2019 15.0.4500.2 General availability

Security

21 vulnerabilities fixed
16 important 5 not rated
VulnerabilitySeverityCVSS
CVE-2026-32176
SQL Server Elevation of Privilege Vulnerability
 Important 6.7
CVE-2026-65674
Microsoft SQL Server Remote Code Execution Vulnerability
 Important —
CVE-2026-67625
Microsoft SQL Server Remote Code Execution Vulnerability
 Important —
CVE-2026-67628
Microsoft SQL Server Information Disclosure Vulnerability
 Important —
CVE-2026-68883
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important —
CVE-2026-70189
Microsoft SQL Server Remote Code Execution Vulnerability
 Important —
CVE-2026-85876
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important —
CVE-2026-85886
Microsoft SQL Server Remote Code Execution Vulnerability
 Important —
CVE-2026-85888
Microsoft SQL Server Information Disclosure Vulnerability
 Important —
CVE-2026-85919
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important —
CVE-2026-88081
Microsoft SQL Server Information Disclosure Vulnerability
 Important —
CVE-2026-88082
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important —
CVE-2026-88084
Microsoft SQL Server Denial of Service Vulnerability
 Important —
CVE-2026-88085
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important —
CVE-2026-88086
Microsoft SQL Server Information Disclosure Vulnerability
 Important —
CVE-2026-88088
Microsoft SQL Server Elevation of Privilege Vulnerability
 Important —
CVE-2026-83945
Microsoft SQL Server Remote Code Execution Vulnerability
 Not rated —
CVE-2026-88089
Microsoft SQL Server Remote Code Execution Vulnerability
 Not rated —
CVE-2026-94512
SQL Server Remote Code Execution Vulnerability
 Not rated —
CVE-2026-94520
Microsoft SQL Server Denial of Service Vulnerability
 Not rated —
CVE-2026-96956
SQL Server Elevation of Privilege Vulnerability
 Not rated —

Downloads (Microsoft Update Catalog)

Package 2019
889.2 MB
sqlserver2019-kb5128494-x64.exe Main update · KB5128494 SHA-1: 4352fd2d…8104f4

Updated components

158 files changed since the previous update for the same versions.

Top changed componentsFiles
SQL Server Engine121
SQL Server PolyBase4

Page history

  1. Superseded by KB5132745

    Removed CVE-2026-88089

    Removed CVE-2026-94512

    Removed CVE-2026-94520

    Removed CVE-2026-96956

Sources

Updated
Cited passages from Microsoft's official notes (23)
  1. 1. Resolves a security vulnerability in PolyBase by improving validation during data processing. support.microsoft.com
  2. 2. Fixes multiple memory-corruption and memory-disclosure vulnerabilities in the SQL Server SQL Satellite protocol message parsing logic that's used by Machine Learning Services and Language Extensions. support.microsoft.com
  3. 3. Addresses an input-validation issue in SQL Server Virtual Device Interface (VDI) and SQL Writer backup paths in which malformed size values potentially cause out-of-bounds memory access. support.microsoft.com
  4. 4. Addresses an integer handling issue in SQL Server backup and restore metadata processing that potentially allows a local authenticated user to gain elevated privileges and cause a service to stop responding. support.microsoft.com
  5. 5. Fixes a security vulnerability in the SQL Server Virtual Device Interface (VDI) in which an out-of-bounds write action potentially occurs while opening a virtual device set. support.microsoft.com
  6. 6. Fixes a security vulnerability in the SQL Server Virtual Device Interface (VDI) in which an out-of-bounds read or write action potentially occurs while processing transferred data during backup or restore operations. support.microsoft.com
  7. 7. Fixes unsafe deserialization of PolyBase rollback queue data so that malformed payloads are rejected. support.microsoft.com
  8. 8. Fixes an issue in which MSDASQL linked server connections fail if the provider string doesn't include a user ID (UID). support.microsoft.com
  9. 9. Fixes an issue in replication operations that affects data validation. support.microsoft.com
  10. 10. Fixes an issue in merge replication Web Synchronization operations that affects data validation. support.microsoft.com
  11. 11. Fixes several security vulnerabilities that allow information disclosure or a denial of service when the Database Engine reads a specially crafted Extended Events (.xel) file. support.microsoft.com
  12. 12. Updates the third-party archive-extraction component that SQL Server uses if external language and external library packages are installed. support.microsoft.com
  13. 13. Adds validation of FILESTREAM fragment size on Availability Group secondary replicas to reject oversized fragments. support.microsoft.com
  14. 14. Improves security and reliability for Queued Updating Subscriptions in Transactional Replication. support.microsoft.com
  15. 15. Improves security and reliability for Queued Updating Subscriptions in Transactional Replication. support.microsoft.com
  16. 16. Improves Showplan input handling to enhance security and reliability. support.microsoft.com
  17. 17. Updates shared memory handling. support.microsoft.com
  18. 18. Updates Native Compare Strings. support.microsoft.com
  19. 19. Strengthens authorization checks for certain replication-related database operations to help prevent unintended disclosure of database information. support.microsoft.com
  20. 20. Limits LoginSid processing within the SQL Trace reader to the internal buffer size to prevent malformed trace data from causing an out-of-bounds read action. support.microsoft.com
  21. 21. Improves security and reliability in replication security metadata handling during Subscriber database restore and upgrade operations. support.microsoft.com
  22. 22. Improves security and reliability for the Log Reader Agent in a heterogeneous transactional replication scenario. support.microsoft.com
  23. 23. Linked server queries that use the MSDASQL (OLE DB Provider for ODBC Drivers) provider and specify a provider string (@provstr) fail and return the following error message: support.microsoft.com
Checked automatically: 7 of 8 checks passed, 23 quoted passages · compared with Microsoft's page on Nov 14, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake