Skip to the content
The Update Bureau
SQL Server 2022 CU27 + GDR SQL Server 2022 CU27 + GDR Security update
Patch Tuesday

KB5129300

KB5129300: Security update for SQL Server 2022, CU branch, November 2026. Recovery-time queries may trigger access violations

In short

Database monitoring queries during recovery might cause an access violation and create a dump file. The security update also fixes vulnerabilities; avoid those queries or use trace flag 4696 as a mitigation.

Does it affect you? Applies to: SQL Server 2022 installations. The update package is for x64; the listed fixes cover Windows and Linux, with some limited to Windows.

Build
16.0.4315.2
Servicing branch
CU
Security
55 fixed
Restart
Required

For servers on the CU branch: they install cumulative updates, which also bring fixes beyond security. Servers on the GDR branch (security fixes only) get a separate update. Which branch am I on?

What changes

Improvements 37 changes

Methods to access stored data

Verified in package 4 items

For: Windows

  • Security for SQL Server index operations is improved.1
    Bug 5624542; SQL Server Engine; Windows.
  • Security for transaction logging in SQL Server is improved.2
    Bug 5624577; SQL Server Engine; Windows.
  • SQL Server improves checks on variable-length column offsets when processing database records.5
    Bug 5624953; SQL Server Engine; Windows.
  • Checks for database metadata are strengthened.6
    Bug 5624995; SQL Server Engine; Windows.

Access Methods

Verified in package

For: Windows

  • Sparse column data checks are improved to strengthen security and reliability.3
    Bug 5624881; SQL Server Engine; Windows.

Column Stores

Verified in package

For: Windows

  • Security for transaction logging in SQL Server is improved.4
    Bug 5624928; SQL Server Engine; Windows.

Replication

Verified in package 26 items
  • Handling of replication security data during subscription database restore and upgrade is more secure and reliable.7
    Bug 5632312; SQL Server Engine; Windows.
  • The Log Reader Agent is more secure and reliable in heterogeneous transactional replication scenarios.8
    Bug 5632800; SQL Server Engine; Windows.
  • Change feed configuration handling is more secure and reliable.9
    Bug 5632813; SQL Server Engine; Windows.
  • An issue affecting data checks in replication operations is addressed.10
    Bug 5632874; SQL Server Engine; Linux and Windows.
  • An issue affecting data checks in Merge Replication Web Synchronization is addressed.11
    Bug 5632887; SQL Server Engine; Linux and Windows.
  • Authorization checks for some replication database operations are stronger to prevent unintended disclosure of database information.12
    Bug 5632927; SQL Server Engine; Windows.
  • Input checks are improved for transaction identifiers handled by replication.13
    Bug 5636097; SQL Server Engine; Linux and Windows.
  • Memory safety is improved when replication handles transaction identifiers.14
    Bug 5636143; SQL Server Engine; Linux and Windows.
  • Security checks for replication during database upgrades are strengthened.17
    Bug 5653496; SQL Server Engine; Windows.
  • Checks for conflict table names in transactional replication are improved.18
    Bug 5653523; SQL Server Engine; Windows.
  • Merge replication stored procedures handle column names better.19
    Bug 5653539; SQL Server Engine; Windows.
  • Parameter checks for the Queue Reader Agent are improved.20
    Bug 5653572; SQL Server Engine; Windows.
  • Identifier checks for transactional replication are improved.21
    Bug 5653581; SQL Server Engine; Windows.
  • Merge replication handles conflict table names better.22
    Bug 5653595; SQL Server Engine; Windows.
  • Security checks for conflict reporting in merge replication are strengthened.23
    Bug 5653628; SQL Server Engine; Windows.
  • Checks for object names in merge replication schema changes are improved.24
    Bug 5653652; SQL Server Engine; Windows.
  • Generated procedures for merge replication handle table names better.25
    Bug 5653707; SQL Server Engine; Windows.
  • Input checks for change processing in merge replication are strengthened.26
    Bug 5653720; SQL Server Engine; Windows.
  • Transactional replication handles schema changes more securely.27
    Bug 5653743; SQL Server Engine; Windows.
  • Security checks for lightweight merge replication operations are strengthened.28
    Bug 5653763; SQL Server Engine; Windows.
  • Security checks for processing queued replication data are improved.29
    Bug 5653807; SQL Server Engine; Windows.
  • Role checks for replication subscription validation are strengthened.31
    Bug 5653832; SQL Server Engine; Windows.
  • Protection for replication data and operations is improved.32
    Bug 5654550; SQL Server Engine; Linux and Windows.
  • Merge Replication error-source parsing now uses bounded validation.35
    Bug 5723139; SQL Server Engine; Windows.
  • Security checks for linked server access in replication are strengthened.36
    Bug 5723341; SQL Server Engine; Linux and Windows.
  • Input checks for Azure Synapse Link for SQL are improved.37
    Bug 5723350; SQL Server Engine; Linux and Windows.

Management Services

Verified in package 2 items
  • Internal stored procedures handle object names better.15
    Bug 5641941; SQL Server Engine; Linux and Windows.
  • Authorization checks for SQL Server Agent job steps are improved.30
    Bug 5653822; SQL Server Engine; Windows.

SQLDiag

For: Windows

  • SQLdiag handles long database names and names with Unicode characters better.16
    Bug 5645705; SQL Server Client Tools; Windows.

Integration Services

For: Windows

  • XSLT scripting is disabled by default. Administrators can restore the previous behavior by setting EnableXsltScript to 1.33
    Bug 5656899; Integration Services on Windows. The setting is under HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\{version}\SSIS\XMLTask.

PolyBase

Verified in package

For: SQL Server installations on Linux and Windows

  • Input checks for PolyBase stored procedures are improved.34
    Bug 5661348; SQL Server Engine; Linux and Windows.

Fixes 14 changes

SQL Connectivity

For: SQL Server installations on Linux and Windows

  • Some client connection requests no longer cause an out-of-bounds memory read.38
    Bug 5270202; SQL Connectivity; Linux and Windows.

Programmability

Verified in package 2 items

For: SQL Server installations on Linux and Windows

  • An XML operation no longer causes a heap buffer overflow.39
    Bug 5622178; SQL Server Engine; Linux and Windows.
  • A specially crafted SQL Trace file no longer lets the Database Engine disclose information or suffer a denial of service.45
    Bug 5635959; SQL Server Engine; Linux and Windows.

Transaction Services

Verified in package

For: Windows

  • XA distributed transaction processing no longer causes memory corruption.40
    Bug 5622471; SQL Server Engine; Windows.

Security Infrastructure

Verified in package

For: Windows

  • Parsing log block records no longer causes an out-of-bounds read.41
    Bug 5624102; SQL Server Engine; Windows.

Access Methods

Verified in package

For: Windows

  • A query no longer returns unintended memory content from a database with a corrupted row-compressed record. SQL Server returns a database corruption error instead.42
    Bug 5624555; SQL Server Engine; Windows.

Replication

Verified in package 5 items
  • Merge replication no longer causes a buffer overflow when processing more than 250 WebSync XML nickname entries.43
    Bug 5632848; SQL Server Engine; Linux and Windows.
  • Replication validation and error handling are fixed to improve security and reliability.44
    Bug 5635179; SQL Server Engine; Windows.
  • The Log Reader Agent no longer causes a heap buffer overflow.49
    Bug 5723292; SQL Server Engine; Windows.
  • An information disclosure flaw in replication queue command decoding is fixed.50
    Bug 5723352; SQL Server Engine; Windows. The affected procedure is xp_decodequeuecmd.
  • Malformed replication article data with missing or sparse column positions no longer makes the Log Reader Agent use invalid rowset bindings.51
    Bug 5723353; SQL Server Engine; Windows.

Integration Services

3 items

For: Windows

  • The SQL task no longer causes a heap over-read when processing OLE DB output parameters.46
    Bug 5657241; Integration Services; Windows.
  • An integer overflow in the HTTP connection manager no longer causes memory access issues.47
    Bug 5657882; Integration Services; Windows.
  • Using the Raw File source component no longer causes a memory access violation.48
    Bug 5658113; Integration Services; Windows.

Known issues

  1. Open Affects: Organizations and IT administrators

    Access violation when you query sys.dm_exec_requests during database recovery

    Queries against sys.dm_exec_requests might cause an access violation and create a dump file while a database is recovering. This can happen during restore, startup recovery, or before an availability group replica comes online.52

    How to apply the workaround SQL Trace Flag

    Enable trace flag 4696, avoid queries against recovering databases, or uninstall the update. With the trace flag, monitoring queries on secondary replicas might return errors 976 or 978.52

    Step-by-step workaround instructions
    2 steps
    Show steps Hide steps
    Step-by-step procedure
    1. Enable trace flag 4696 to opt out of the code change.
    2. Alternatively, avoid queries against sys.dm_exec_requests for databases that are recovering, or uninstall the update.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-11-10
Classification
Security Updates
Type
Cumulative update
Servicing branch
CU
Restart
Required
Replaces
KB5126934, KB5104824, KB5122768, KB5093420
+30 earlier KB5101347, KB5081477, KB5089900, KB5083252, KB5080999, KB5077464, KB5078297, KB5072936, KB5068450, KB5068406, KB5065865, KB5065220, KB5063814, KB5059390, KB5058721, KB5054531, KB5050771, KB5048038, KB5048033, KB5046862, KB5046059, KB5041321, KB5042578, KB5038325, KB5040939, KB5036432, KB5036343, KB5033663, KB5032679, KB5033592
VersionBuildChannel
2022 16.0.4315.2 General availability

Security

55 vulnerabilities fixed
54 important 1 not rated
VulnerabilitySeverityCVSS

The table lists the 0 exploited, publicly disclosed or critical vulnerabilities. See all 55 vulnerabilities →

Downloads (Microsoft Update Catalog)

Package 2022
469.7 MB
sqlserver2022-kb5129300-x64.exe Main update · KB5129300 SHA-1: cf722943…872c10

Updated components

146 files changed since the previous update for the same versions.

Top changed componentsFiles
SQL Server Engine114
SQL Server PolyBase3

Verified in package: changed files confirm Methods to access stored data, Access Methods, Column Stores, Replication, Management Services, PolyBase, Programmability, Transaction Services, Security Infrastructure.

Page history

  1. Added 6 vulnerabilities (6 important)

Sources

Updated
Cited passages from Microsoft's official notes (52)
  1. 1. Improves security for index operations in SQL Server. support.microsoft.com
  2. 2. Improves security for transaction logging in SQL Server. support.microsoft.com
  3. 3. Improves validation of sparse column data in SQL Server to enhance security and reliability. support.microsoft.com
  4. 4. Improves security for transaction logging in SQL Server. support.microsoft.com
  5. 5. Improves the validation of variable-length column offsets if SQL Server processes database records. support.microsoft.com
  6. 6. Strengthens database metadata validation in SQL Server. support.microsoft.com
  7. 7. Improves the security and reliability of the handling of replication security metadata during subscription database restore and upgrade operations. support.microsoft.com
  8. 8. Improves the security and reliability of the Log Reader Agent in heterogeneous transactional replication scenarios. support.microsoft.com
  9. 9. Improves the security and reliability of the change feed configuration. support.microsoft.com
  10. 10. Addresses an issue in replication operations that affects data validation. support.microsoft.com
  11. 11. Addresses an issue in Merge Replication Web Synchronization operations that affects data validation. support.microsoft.com
  12. 12. Strengthens authorization checks for certain replication-related database operations to prevent unintended disclosure of database information. support.microsoft.com
  13. 13. Improves input validation for transaction identifiers that replication processes. support.microsoft.com
  14. 14. Improves memory safety if replication processes transaction identifiers. support.microsoft.com
  15. 15. Improves the handling of object names in internal stored procedures. support.microsoft.com
  16. 16. Improves the handling of database names in SQLdiag for long names and names that contain Unicode characters. support.microsoft.com
  17. 17. Strengthens security validation for replication during database upgrades. support.microsoft.com
  18. 18. Improves the validation of conflict table names for transactional replication. support.microsoft.com
  19. 19. Improves the handling of column names in merge replication stored procedures. support.microsoft.com
  20. 20. Improves parameter validation for the Queue Reader Agent. support.microsoft.com
  21. 21. Improves identifier validation for transactional replication. support.microsoft.com
  22. 22. Improves the handling of conflict table names in merge replication. support.microsoft.com
  23. 23. Strengthens security validation for conflict reporting in merge replication. support.microsoft.com
  24. 24. Improves the validation of object names for schema changes in merge replication. support.microsoft.com
  25. 25. Improves the handling of table names in the generated procedures for merge replication. support.microsoft.com
  26. 26. Strengthens input validation for change processing in merge replication. support.microsoft.com
  27. 27. Improves security if transactional replication processes schema changes. support.microsoft.com
  28. 28. Strengthens security checks for lightweight merge replication operations. support.microsoft.com
  29. 29. Improves security validation for the processing of queued replication data. support.microsoft.com
  30. 30. Improves authorization validation for SQL Server Agent job steps. support.microsoft.com
  31. 31. Strengthens role validation for replication subscription checks. support.microsoft.com
  32. 32. Improves the protection of replication data and operations. support.microsoft.com
  33. 33. Disables XSLT scripting by default. To restore previous behavior, set EnableXsltScript to 1 under HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\{version}\SSIS\XMLTask. support.microsoft.com
  34. 34. Improves input validation for PolyBase stored procedures. support.microsoft.com
  35. 35. Improves Merge Replication error-source parsing by adding bounded validation. support.microsoft.com
  36. 36. Strengthens security checks for linked server access in replication. support.microsoft.com
  37. 37. Improves input validation for Azure Synapse Link for SQL. support.microsoft.com
  38. 38. Fixes an out-of-bounds memory read action that can occur during processing of certain client connection requests. support.microsoft.com
  39. 39. Fixes a heap buffer overflow during XML operation. support.microsoft.com
  40. 40. Fixes a memory corruption issue in XA distributed transaction processing. support.microsoft.com
  41. 41. Fixes an out-of-bounds read action in log block record parsing. support.microsoft.com
  42. 42. Fixes an issue in which querying a database that contains a corrupted row-compressed record can return unintended memory content. SQL Server now returns a database corruption error message instead. support.microsoft.com
  43. 43. Fixes a buffer overflow that occurs if merge replication processes more than 250 WebSync XML nickname entries. support.microsoft.com
  44. 44. Fixes an issue in replication validation and error handling to improve security and reliability. support.microsoft.com
  45. 45. Fixes a security vulnerability that allows information disclosure or a denial of service if the SQL Database Engine reads a specially crafted SQL Trace file. support.microsoft.com
  46. 46. Fixes a heap over-read action that occurs if the SQL task in SQL Server Integration Services processes OLE DB output parameters. support.microsoft.com
  47. 47. Fixes an integer overflow that can cause memory access issues in the HTTP connection manager of SQL Server Integration Services. support.microsoft.com
  48. 48. Fixes a memory access violation that might occur when you use the Raw File source component of SQL Server Integration Services. support.microsoft.com
  49. 49. Fixes a heap buffer overflow that can occur in the Log Reader Agent. support.microsoft.com
  50. 50. Fixes an information disclosure vulnerability in replication queue command decoding in xp_decodequeuecmd. support.microsoft.com
  51. 51. Fixes an issue in which malformed replication article metadata that has missing or sparse column ordinals can cause the Log Reader Agent to access invalid rowset bindings. support.microsoft.com
  52. 52. Queries against sys.dm_exec_requests might raise an access violation and generate a dump file if they run while a database is still recovering. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 52 quoted passages · compared with Microsoft's page on Nov 15, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 3/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake