Skip to the content
The Update Bureau
SQL Server 2025 CU10 + GDR SQL Server 2025 CU10 + GDR Security update
Patch Tuesday

KB5129299

KB5129299: Security update for SQL Server 2025, CU branch, November 2026. Recovery monitoring queries can crash the database engine

In short

Queries against sys.dm_exec_requests might raise an access violation while a database is recovering. The release also fixes security flaws across SQL Server components.

Does it affect you? Applies to: SQL Server 2025 on Windows or Linux, all editions. The package is for x64 systems.

Build
17.0.5045.3
Servicing branch
CU
Security
59 fixed
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • This page Queries against sys.dm_exec_requests might raise an access violation and generate a dump file while a database is recovering. This can happen during restore, startup recovery, or before an availability group replica comes online.

The official sources are linked at the end of the page.

For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?

What changes

Improvements 42 changes

Integration Services

  • XSLT scripting is disabled by default.1
    To restore the previous behavior, set EnableXsltScript to 1 under HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\{version}\SSIS\XMLTask.

Methods to access stored data

Verified in package 4 items
  • Security for index operations is improved.2
    SQL Server Engine; Windows.
  • Security for transaction logging is improved.3
    SQL Server Engine; Windows.
  • Validation of variable-length column offsets is improved when database records are processed.6
    SQL Server Engine; Windows.
  • Database metadata validation is strengthened.7
    SQL Server Engine; Windows.

Access Methods

Verified in package
  • Validation of sparse column data is improved for better security and reliability.4
    SQL Server Engine; Windows.

Column Stores

Verified in package
  • Security for transaction logging is improved.5
    SQL Server Engine; Windows.

Replication

Verified in package 31 items
  • Replication security metadata is handled more securely and reliably during subscriber database restore and upgrade.8
    SQL Server Engine; Windows.
  • Replication security metadata is handled more securely and reliably during subscriber database restore and upgrade.8
    SQL Server Engine; Windows.
  • The Log Reader Agent is more secure and reliable in heterogeneous transactional replication.9
    SQL Server Engine; Windows.
  • The Log Reader Agent is more secure and reliable in heterogeneous transactional replication.9
    SQL Server Engine; Windows.
  • Change feed configuration is more secure and reliable.10
    SQL Server Engine; Windows.
  • Change feed configuration is more secure and reliable.10
    SQL Server Engine; Windows.
  • Authorization checks are stronger for certain replication-related database operations, helping prevent unintended disclosure.11
    SQL Server Engine; Windows.
  • Authorization checks are stronger for certain replication-related database operations, helping prevent unintended disclosure.11
    SQL Server Engine; Windows.
  • Security validation is stronger for stored procedures used by merge replication.12
    SQL Server Engine; Windows.
  • Input validation is improved for transaction identifiers processed by replication.13
    SQL Server Engine.
  • Input validation is improved for transaction identifiers processed by replication.13
    SQL Server Engine.
  • Memory safety is improved when replication processes transaction identifiers.14
    SQL Server Engine.
  • Memory safety is improved when replication processes transaction identifiers.14
    SQL Server Engine.
  • Security validation is stronger for replication during database upgrades.17
    SQL Server Engine; Windows.
  • Conflict table name validation is improved for transactional replication.18
    SQL Server Engine; Windows.
  • Merge replication stored procedures handle column names better.19
    SQL Server Engine; Windows.
  • Parameter validation is improved for the Queue Reader Agent.20
    SQL Server Engine; Windows.
  • Identifier validation is improved for transactional replication.21
    SQL Server Engine; Windows.
  • Merge replication handles conflict table names better.22
    SQL Server Engine; Windows.
  • Security validation is stronger for conflict reporting in merge replication.23
    SQL Server Engine; Windows.
  • Object name validation is improved for schema changes in merge replication.24
    SQL Server Engine; Windows.
  • Generated procedures for merge replication handle table names better.25
    SQL Server Engine; Windows.
  • Input validation is stronger for change processing in merge replication.26
    SQL Server Engine; Windows.
  • Security is improved when transactional replication processes schema changes.27
    SQL Server Engine; Windows.
  • Security checks are stronger for lightweight merge replication operations.28
    SQL Server Engine; Windows.
  • Security validation is improved when queued replication data is processed.29
    SQL Server Engine; Windows.
  • Role validation is stronger for replication subscription checks.31
    SQL Server Engine; Windows.
  • The protection of replication data and operations is improved.32
    SQL Server Engine.
  • Security checks are stronger for linked server access in replication.34
    SQL Server Engine.
  • Merge Replication error-source parsing uses bounded validation.35
    SQL Server Engine; Windows.
  • Input validation is improved for Azure Synapse Link for SQL.36
    SQL Server Engine.

Management Services

Verified in package 2 items
  • Internal stored procedures handle object names better.15
    SQL Server Engine.
  • Authorization validation is improved for SQL Server Agent job steps.30
    SQL Server Engine; Windows.

SQLDiag

  • SQLdiag handles long database names and names with Unicode characters better.16
    SQL Server Client Tools; Windows.

PolyBase

Verified in package
  • Input validation is improved for PolyBase stored procedures.33
    SQL Server Engine.

Fixes 29 changes

SQL Connectivity

2 items
  • Certain client connection requests no longer cause an out-of-bounds memory read.37
  • Certain client connection requests no longer cause an out-of-bounds memory read.37

Programmability

Verified in package 9 items
  • An XML operation no longer causes a heap buffer overflow.38
    SQL Server Engine.
  • An XML operation no longer causes a heap buffer overflow.38
    SQL Server Engine.
  • Deeply nested JSON paths no longer crash SQL Server; an error is returned instead.41
    The issue occurred when JSON functions processed a path with more than 128 nesting levels.
  • Merging JSON array data no longer causes data corruption or an unexpected dump file.42
    SQL Server Engine.
  • Merging JSON array data no longer causes data corruption or an unexpected dump file.42
    SQL Server Engine.
  • JSON_VALUE no longer exposes unintended memory content in a conversion error message.43
    Applies when JSON_VALUE is used with RETURNING and multibyte UTF-8 input; Windows.
  • JSON_VALUE no longer exposes unintended memory content in a conversion error message.43
    Applies when JSON_VALUE is used with RETURNING and multibyte UTF-8 input; Windows.
  • A security flaw that could expose information or cause a denial of service when reading a crafted SQL Trace file is fixed.52
    SQL Server Engine.
  • A security flaw that could expose information or cause a denial of service when reading a crafted SQL Trace file is fixed.52
    SQL Server Engine.

Extensibility

Verified in package
  • Permissions are cleaned up correctly when EXTERNAL MODEL objects are dropped.39
    SQL Server Engine.

Transaction Services

  • Memory corruption in XA distributed transaction processing is fixed.40
    Windows.

Integration Services

3 items
  • Using the Raw File source component no longer causes a possible memory access violation.44
    SQL Server Integration Services.
  • An integer overflow in the HTTP connection manager no longer risks memory access issues.45
    SQL Server Integration Services.
  • Using the Raw File source component no longer causes a possible memory access violation.44
    SQL Server Integration Services.

Security Infrastructure

Verified in package
  • An out-of-bounds read in log block record parsing is fixed.46
    SQL Server Engine; Windows.

Access Methods

Verified in package
  • Queries on a database with a corrupted row-compressed record return a corruption error instead of unintended memory content.47
    SQL Server Engine; Windows.

Replication

Verified in package 11 items
  • Merge replication no longer causes a buffer overflow when it processes more than 250 WebSync XML nickname entries.48
    SQL Server Engine.
  • Merge replication no longer causes a buffer overflow when it processes more than 250 WebSync XML nickname entries.48
    SQL Server Engine.
  • An issue affecting data validation in replication operations is addressed.49
    SQL Server Engine.
  • An issue affecting data validation in replication operations is addressed.49
    SQL Server Engine.
  • An issue affecting data validation in Merge Replication Web Synchronization is addressed.50
    SQL Server Engine.
  • An issue affecting data validation in Merge Replication Web Synchronization is addressed.50
    SQL Server Engine.
  • An issue in Change Event Streaming input data processing is addressed.51
    SQL Server Engine.
  • An issue in Change Event Streaming input data processing is addressed.51
    SQL Server Engine.
  • A heap buffer overflow in the Log Reader Agent is fixed.53
    SQL Server Engine; Windows.
  • An information disclosure vulnerability in replication queue command decoding is fixed.54
    The affected function is xp_decodequeuecmd; SQL Server Engine; Windows.
  • Malformed replication article metadata no longer causes the Log Reader Agent to use invalid rowset bindings.55
    The issue involved missing or sparse column ordinals; SQL Server Engine; Windows.

Known issues

  1. Open Affects: Organizations and IT administrators

    Access violation when you query sys.dm_exec_requests during database recovery

    Queries against sys.dm_exec_requests might raise an access violation and create a dump file while a database is recovering. This can happen during restore, startup recovery, or before an availability group replica comes online.56

    How to apply the workaround SQL Trace Flag

    Enable trace flag 4696, avoid querying sys.dm_exec_requests for databases that are recovering, or uninstall the update. With the trace flag, queries against sys.dm_exec_requests or sys.sysprocesses on secondary replicas might return errors 976 or 978.56

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-11-10
Classification
Security Updates
Type
Cumulative update
Servicing branch
CU
Restart
Required
Replaces
KB5125471, KB5126967, KB5122048, KB5122769
+12 earlier KB5104822, KB5096981, KB5101346, KB5093421, KB5084896, KB5089899, KB5081495, KB5083245, KB5077896, KB5077466, KB5075211, KB5078298
VersionBuildChannel
2025 17.0.5045.3 General availability

Security

59 vulnerabilities fixed
57 important 2 not rated
VulnerabilitySeverityCVSS

The table lists the 0 exploited, publicly disclosed or critical vulnerabilities. See all 59 vulnerabilities →

Downloads (Microsoft Update Catalog)

Package 2025
416.3 MB
sqlserver2025-kb5129299-x64.exe Main update · KB5129299 SHA-1: eabd651a…0dc88b

Updated components

141 files changed since the previous update for the same versions.

Top changed componentsFiles
SQL Server Engine112
SQL Server PolyBase3

Verified in package: changed files confirm Methods to access stored data, Access Methods, Column Stores, Replication, Management Services, PolyBase, Programmability, Extensibility, Security Infrastructure.

Page history

  1. Added 6 vulnerabilities (6 important)

Sources

Updated
Cited passages from Microsoft's official notes (56)
  1. 1. Disables XSLT scripting by default. To restore previous behavior, set EnableXsltScript to 1 under HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\{version}\SSIS\XMLTask. support.microsoft.com
  2. 2. Improves security for index operations in SQL Server. support.microsoft.com
  3. 3. Improves security for transaction logging in SQL Server. support.microsoft.com
  4. 4. Improves validation of sparse column data in SQL Server to enhance security and reliability. support.microsoft.com
  5. 5. Improves security for transaction logging in SQL Server. support.microsoft.com
  6. 6. Improves the validation of variable-length column offsets if SQL Server processes database records. support.microsoft.com
  7. 7. Strengthens database metadata validation in SQL Server. support.microsoft.com
  8. 8. Improves the security and reliability of replication security metadata handling during subscriber database restore and upgrade operations. support.microsoft.com
  9. 9. Improves the security and reliability of the Log Reader Agent in heterogeneous transactional replication scenarios. support.microsoft.com
  10. 10. Improves the security and reliability of the change feed configuration. support.microsoft.com
  11. 11. Strengthens authorization checks for certain replication-related database operations to prevent unintended disclosure of database information. support.microsoft.com
  12. 12. Strengthens security validation for stored procedures that are used by merge replication. support.microsoft.com
  13. 13. Improves input validation for transaction identifiers that replication processes. support.microsoft.com
  14. 14. Improves memory safety if replication processes transaction identifiers. support.microsoft.com
  15. 15. Improves the handling of object names in internal stored procedures. support.microsoft.com
  16. 16. Improves the handling of database names in SQLdiag for long names and names that contain Unicode characters. support.microsoft.com
  17. 17. Strengthens security validation for replication during database upgrades. support.microsoft.com
  18. 18. Improves the validation of conflict table names for transactional replication. support.microsoft.com
  19. 19. Improves the handling of column names in merge replication stored procedures. support.microsoft.com
  20. 20. Improves parameter validation for the Queue Reader Agent. support.microsoft.com
  21. 21. Improves identifier validation for transactional replication. support.microsoft.com
  22. 22. Improves the handling of conflict table names in merge replication. support.microsoft.com
  23. 23. Strengthens security validation for conflict reporting in merge replication. support.microsoft.com
  24. 24. Improves the validation of object names for schema changes in merge replication. support.microsoft.com
  25. 25. Improves the handling of table names in the generated procedures for merge replication. support.microsoft.com
  26. 26. Strengthens input validation for change processing in merge replication. support.microsoft.com
  27. 27. Improves security if transactional replication processes schema changes. support.microsoft.com
  28. 28. Strengthens security checks for lightweight merge replication operations. support.microsoft.com
  29. 29. Improves security validation for the processing of queued replication data. support.microsoft.com
  30. 30. Improves authorization validation for SQL Server Agent job steps. support.microsoft.com
  31. 31. Strengthens role validation for replication subscription checks. support.microsoft.com
  32. 32. Improves the protection of replication data and operations. support.microsoft.com
  33. 33. Improves input validation for PolyBase stored procedures. support.microsoft.com
  34. 34. Strengthens security checks for linked server access in replication. support.microsoft.com
  35. 35. Improves Merge Replication error-source parsing by adding bounded validation. support.microsoft.com
  36. 36. Improves input validation for Azure Synapse Link for SQL. support.microsoft.com
  37. 37. Fixes an out-of-bounds memory read action that can occur during processing of certain client connection requests. support.microsoft.com
  38. 38. Fixes a heap buffer overflow during XML operation. support.microsoft.com
  39. 39. Fixes an issue in which permissions aren't cleaned up correctly if EXTERNAL MODEL objects are dropped. support.microsoft.com
  40. 40. Fixes a memory corruption issue in XA distributed transaction processing. support.microsoft.com
  41. 41. Fixes an access violation that can occur if JSON functions process a path that has more than 128 nesting levels. SQL Server now returns an error instead of crashing. support.microsoft.com
  42. 42. Fixes an issue in which merging JSON array data can cause data corruption or an unexpected SQL Server dump file. support.microsoft.com
  43. 43. Fixes an issue in which JSON_VALUE can include unintended memory content in a conversion error message if it's used together with RETURNING and multibyte UTF-8 input. support.microsoft.com
  44. 44. Fixes a memory access violation that might occur when you use the Raw File source component of SQL Server Integration Services. support.microsoft.com
  45. 45. Fixes an integer overflow that can cause memory access issues in the HTTP connection manager of SQL Server Integration Services. support.microsoft.com
  46. 46. Fixes an out-of-bounds read action in log block record parsing. support.microsoft.com
  47. 47. Fixes an issue in which querying a database that contains a corrupted row-compressed record can return unintended memory content. SQL Server now returns a database corruption error message instead. support.microsoft.com
  48. 48. Fixes a buffer overflow that occurs if merge replication processes more than 250 WebSync XML nickname entries. support.microsoft.com
  49. 49. Addresses an issue in replication operations that affects data validation. support.microsoft.com
  50. 50. Addresses an issue in Merge Replication Web Synchronization operations that affects data validation. support.microsoft.com
  51. 51. Addresses an issue in Change Event Streaming input data processing. support.microsoft.com
  52. 52. Fixes a security vulnerability that allows information disclosure or a denial of service if the SQL Database Engine reads a specially crafted SQL Trace file. support.microsoft.com
  53. 53. Fixes a heap buffer overflow that can occur in the Log Reader Agent. support.microsoft.com
  54. 54. Fixes an information disclosure vulnerability in replication queue command decoding in xp_decodequeuecmd. support.microsoft.com
  55. 55. Fixes an issue in which malformed replication article metadata that has missing or sparse column ordinals can cause the Log Reader Agent to access invalid rowset bindings. support.microsoft.com
  56. 56. Queries against sys.dm_exec_requests might raise an access violation and generate a dump file if they run while a database is still recovering. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 56 quoted passages · compared with Microsoft's page on Nov 15, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 3/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake