KB5129223: Cumulative update for SQL Server 2025, CU branch, November 2026. Parallel SESSION_CONTEXT queries can return wrong results

For: SQL Server installations on all platforms

• Some window queries might return incorrect results when a partition column uses a case-insensitive collation. This is fixed.¹
  Fixes string predicates over window aggregates when the partitioning column uses a case-insensitive collation.

For: Windows installations using availability groups

• Some monitoring queries might fail on a read-intent-only secondary replica in an availability group. This is fixed.²
  Addresses intermittent error 976 or 978 results from queries using sys.dm_exec_requests or sys.sysprocesses.
• An availability group listener that uses a DHCP address can come online again.⁵
  Fixes the issue that prevents an availability group listener using a Dynamic Host Configuration Protocol (DHCP) address from coming online.

• Decrypting empty or NULL values in certain Always Encrypted columns no longer causes error 33550.³
  Fixes error 33550, state 42, when a secure enclave decrypts empty or NULL values in varchar(max), nvarchar(max), or varbinary(max) columns.
• An ALTER SYMMETRIC KEY operation can use an asymmetric key from an EKM provider on Linux.¹³
  Fixes failure when ALTER SYMMETRIC KEY uses ADD ENCRYPTION BY ASYMMETRIC KEY with an Extensible Key Management provider.

• A query run from a Service Broker stored procedure no longer causes a connection to end unexpectedly.⁴
  Fixes an access violation when sys.dm_exec_describe_first_result_set runs from a Service Broker-activated stored procedure.
• JSON functions return an error instead of crashing when they process a path with more than 128 nesting levels.¹⁴
  Fixes an access violation when JSON functions process paths with more than 128 nesting levels.
• ALTER DATABASE CURRENT ADD FILE no longer returns error 42019 on certain Azure SQL Managed Instance service tiers.²³
  Applies to General Purpose and Next-gen General Purpose service tiers.

For: SQL Server installations on all platforms

• Database performance counters no longer go missing after you run DBCC CHECKDB.⁶
  Fixes missing database performance counters after DBCC CHECKDB runs.
• Queries on databases with many tables, indexes, or partitions no longer cause non-yielding scheduler errors or dump files.¹⁹
  Fixes issues when querying sys.dm_db_index_operational_stats on databases with a very large number of tables, indexes, or partitions.

For: SQL Server installations on all platforms

• The hadr_log_block_decompression event reports the compressed and uncompressed log block sizes correctly.⁷
  Fixes the hadr_log_block_decompression extended event reporting the same value for both sizes.

For: Windows installations using Integration Services

• Reading data with the Integration Services Raw File source no longer causes a memory access violation.⁸
  Fixes a memory access violation that might occur when the Raw File source component reads data.
• The Integration Services HTTP Connection Manager no longer has an integer overflow that can cause invalid memory access.⁹
• Truncated OLE DB output parameters no longer cause invalid memory access in the Execute SQL Task.¹⁰
  Fixes the issue when the task handles truncated OLE DB output parameters.

For: Windows installations using Analysis Services

• Some MDX queries now include hidden leaf members in their results instead of missing rows or lower measure totals.¹¹
  Fixes nested subselects over ragged hierarchies configured with HideMemberIf.
• Some MDX queries no longer cause Analysis Services to stop unexpectedly.¹²
  Fixes the issue when relational OLAP mode and proactive caching are enabled.

For: SQL Server installations on all platforms

• Permissions are cleaned up when an EXTERNAL MODEL is dropped.¹⁵

For: SQL Server installations on all platforms

• A query on a corrupted row-compressed record now returns a database corruption error instead of unintended memory content.¹⁶
  SQL Server validates compressed-record metadata.

• Online index or constraint changes running alongside data changes no longer cause assertion failures during change capture.¹⁷
• Authorization checks for merge replication row metadata are corrected.¹⁸
• The replication queue command decoder no longer exposes information.²⁴
  Fixes an information disclosure vulnerability in xp_decodequeuecmd.
• The Log Reader Agent no longer risks a heap buffer overflow when it handles single quotation marks in column values.²⁵
• Merge replication improves subscriber validation checks to fix an elevation of privilege vulnerability.²⁶

For: SQL Server installations on all platforms

• Online index operations can run alongside data changes when Change Data Capture is enabled.²⁰
  Fixes an error when an online index operation runs concurrently with DML operations in a database with Change Data Capture enabled.

For: Windows installations

• An oversized user instance name no longer disrupts SQL Server VSS Writer backups or snapshots or causes an out-of-bounds memory write.²¹
  Fixes an input validation issue in SQL Server VSS Writer.

For: Linux installations

• Extended Events log files can be created on Linux loop devices that use certain sector sizes.²²

For: Windows installations using Integration Services

• XSLT scripting is off by default in the Integration Services XML Task.²⁷
  To restore the previous behavior, set EnableXsltScript to 1 under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server{version}\SSIS\XMLTask.

• Merge replication checks identifiers more reliably.²⁸
  Improves identifier validation in merge replication.
• Transactional replication checks identifiers more reliably.³⁰
  Improves identifier validation in transactional replication.
• Merge replication checks retry information more carefully.³⁹
  Improves bounds validation when merge replication processes retry information.
• Stored procedures used by merge replication receive stronger security checks.⁴⁰
• Replication database upgrades receive stronger security checks.⁴³
• Transactional replication checks conflict table names more carefully.⁴⁴
• The Replication Queue Reader Agent checks parameters more carefully.⁴⁵
  Improves parameter validation in the Replication Queue Reader Agent.
• Merge replication handles conflict table names more reliably.⁴⁶
• Merge replication checks conflict reports more securely.⁴⁷
• Merge replication checks object names more carefully when schemas change.⁴⁸
• Generated merge replication procedures handle table names more reliably.⁴⁹
• SQL Server checks inputs more carefully when it processes merge replication changes.⁵⁰
• SQL Server improves security when it processes schema changes in transactional replication.⁵¹
• Lightweight merge replication operations receive stronger security checks.⁵²
• SQL Server checks queued replication data more securely.⁵³
• Replication subscription checks validate roles more carefully.⁵⁵
• Replication data and operations receive stronger security checks.⁵⁶
• The Replication Queue Reader Agent checks queued update messages more carefully.⁵⁸
  Improves bounds validation when the agent processes queued update messages.
• Replication metadata checks improve security and reliability.⁶⁰
• Replication linked-server access receives stronger security checks.⁶¹
• Azure Synapse Link for SQL checks its inputs more carefully.⁶²
• The Replication Queue Reader Agent checks parameters and data conversions more carefully.⁶³
• Merge replication checks error sources more carefully to address a security vulnerability.⁶⁴
• The sp_MStable_validation procedure checks column-list inputs to address a security vulnerability.⁶⁵

For: SQL Server installations on all platforms

• XA stored procedures now catch undersized output buffers and return error 47204.²⁹
  Improves output-buffer validation to prevent buffer overflows.

For: Windows installations

• SQL Server checks transaction log blocks more carefully during recovery and log scans.³¹
  Improves validation to prevent out-of-bounds memory reads when scanning malformed records.

For: Windows installations

• SQL Server initializes buffers used when it builds index records and splits B-tree pages.³²
  Improves security by initializing buffers used during index record construction and B-tree page splits.
• SQL Server initializes buffers used during storage and record operations.³³
  Improves security during insert, update, bulk, compression, and record reconstruction operations.
• SQL Server checks page-compressed record data more carefully.³⁴
  Improves validation of long-column offsets to reject malformed record metadata.
• SQL Server checks sparse-column records more carefully when it reads or rebuilds them.³⁵
  Improves validation of sparse-column record headers and column offsets.
• SQL Server checks variable-length column offsets when it processes database records.³⁷
• SQL Server checks column metadata to prevent out-of-bounds memory writes when it loads database schemas.³⁸

For: Windows installations

• SQL Server checks columnstore header sizes when it attaches, restores, or checks a database.³⁶

• Internal stored procedures check object names while keeping their existing behavior.⁴¹
  Improves object name validation in internal stored procedures.
• SQL Server Agent job steps receive stronger authorization checks.⁵⁴

For: Windows installations using SQLDiag

• SQLDiag handles long and Unicode database names more reliably.⁴²
  Improves diagnostic collection reliability and security.

• Native SQL Server installations on Linux handle operating system resource limits more reliably.⁵⁷
  Improves resource-limit configuration, including mssql-conf startup, without changing container launch behavior.

For: SQL Server installations on all platforms

• The sys.sp_polybase_show_objects procedure checks its inputs more carefully.⁵⁹

• Certificate authentication is supported for endpoints on systems that use only TLS 1.3.⁶⁶
  Startup trace flag 12389 disables this support.
• Service Broker endpoints can use TLS through Schannel.⁶⁷
• Three procedures can reseed, repair, or check databases in multi-database link mode with Azure SQL Managed Instance.⁷⁰
  sys.sp_milink_reseed restarts seeding without removing and re-adding the database to the availability group; sys.sp_milink_repair repairs a broken link; sys.sp_milink_check checks database health.

For: SQL Server installations on all platforms

• A new Japanese collation is available for databases.⁶⁸
  Use sys.sp_db_ebcdic930_collation to enable SQL_Japanese_180_EBCDIC930_CS_AS_UTF8 for a database.

For: SQL Server installations on all platforms

• Trace flag 683 can reduce CPU use in a specific latch condition.⁶⁹
  The flag reduces CPU overhead when heap or B-tree (HoBt) latches are promoted to superlatches but counter partitioning does not occur.