KB5132745: Security update for SQL Server 2019, CU branch, November 2026. Replication and SSIS memory flaws fixed; XSLT scripting disabled

For: SQL Server administrators on Windows

• Index operations have stronger security protections.¹
  Improves security for index operations in SQL Server.
• Transaction logging has stronger security protections.²
  Improves security for transaction logging in SQL Server.
• SQL Server checks variable-length column offsets more carefully when it processes database records.⁵
  Improves the validation of variable-length column offsets if SQL Server processes database records.
• SQL Server checks database metadata more carefully.⁶
  Strengthens database metadata validation in SQL Server.

For: SQL Server administrators on Windows

• SQL Server checks sparse column data more carefully to improve security and reliability.³
  Improves validation of sparse column data in SQL Server to enhance security and reliability.

For: SQL Server administrators on Windows

• Transaction logging has stronger security protections.⁴
  Improves security for transaction logging in SQL Server.

• Some replication database operations check authorization more carefully to prevent unintended disclosure of database information.⁷
  Strengthens authorization checks for certain replication-related database operations to prevent unintended disclosure of database information.
• Replication security metadata is handled more securely and reliably when a subscription database is restored or upgraded.⁹
  Improves the security and reliability of the handling of replication security metadata during subscription database restore and upgrade operations.
• The Log Reader Agent works more securely and reliably in heterogeneous transactional replication setups.¹⁰
  Improves the security and reliability of the Log Reader Agent in heterogeneous transactional replication scenarios.
• Replication checks column positions in rowsets more carefully.¹²
  Improves validation of column ordinals in replication rowsets.
• Replication security checks during database upgrades are stronger.¹³
  Strengthens security validation for replication during database upgrades.
• Transactional replication checks conflict table names more carefully.¹⁴
  Improves the validation of conflict table names for transactional replication.
• Merge replication stored procedures handle column names more reliably.¹⁵
  Improves the handling of column names in merge replication stored procedures.
• Transactional replication checks identifiers more carefully.¹⁶
  Improves identifier validation for transactional replication.
• Merge replication handles conflict table names more reliably.¹⁷
  Improves the handling of conflict table names in merge replication.
• Merge replication checks security when it reports conflicts.¹⁸
  Strengthens security validation for conflict reporting in merge replication.
• Generated merge replication procedures handle table names more reliably.¹⁹
  Improves the handling of table names in the generated procedures for merge replication.
• Merge replication checks input data more carefully when it processes changes.²⁰
  Strengthens input validation for change processing in merge replication.
• Transactional replication handles schema changes with stronger security checks.²¹
  Improves security if transactional replication processes schema changes.
• Lightweight merge replication operations have stronger security checks.²²
  Strengthens security checks for lightweight merge replication operations.
• Queued replication data gets stronger security checks as it is processed.²³
  Improves security validation for the processing of queued replication data.
• Replication data and operations get stronger protection.²⁴
  Improves the protection of replication data and operations.
• Merge replication checks error sources within set limits.²⁷
  Improves Merge Replication error-source parsing by adding bounded validation.
• Replication checks linked server access more carefully.²⁸
  Strengthens security checks for linked server access in replication.

For: SQL Server administrators on Linux and Windows

• Internal stored procedures handle object names more reliably.⁸
  Improves the handling of object names in internal stored procedures.

For: SQL Server administrators on Windows

• SQLDiag handles long database names and names with Unicode characters more reliably.¹¹
  Improves the handling of database names in SQLdiag for long names and names that contain Unicode characters.

For: SQL Server administrators on Windows

• Integration Services no longer runs XSLT scripting by default. You can restore the previous behavior by changing a registry setting.²⁵
  Disables XSLT scripting by default. To restore previous behavior, set EnableXsltScript to 1 under HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\{version}\SSIS\XMLTask.

For: SQL Server administrators on Linux and Windows

• PolyBase stored procedures check input data more carefully.²⁶
  Improves input validation for PolyBase stored procedures.

For: SQL Server administrators on Linux and Windows

• SQL Server avoids reading outside valid memory while handling some client connection requests.²⁹
  Fixes an out-of-bounds memory read action that can occur during processing of certain client connection requests.

For: SQL Server administrators on Linux and Windows

• A specially crafted event file can no longer expose information or cause a denial of service when read by the database engine.³⁰
  Resolves several security vulnerabilities that allow information disclosure or a denial of service if the SQL Database Engine reads a specially crafted Extended Events (.xel) file.

For: SQL Server administrators on Linux and Windows

• A specially crafted SQL Trace file can no longer expose information or cause a denial of service when read by the database engine.³¹
  Fixes a security vulnerability that allows information disclosure or a denial of service if the SQL Database Engine reads a specially crafted SQL Trace file.
• An XML operation no longer causes a heap buffer overflow.³²
  Fixes a heap buffer overflow during XML operation.

For: SQL Server administrators on Windows

• XA distributed transactions no longer cause memory corruption.³³
  Fixes a memory corruption issue in XA distributed transaction processing.

For: SQL Server administrators on Windows

• SQL Server avoids reading outside valid memory while parsing log records.³⁴
  Fixes an out-of-bounds read action in log block record parsing.

For: SQL Server administrators on Windows

• A query no longer returns unintended memory content from a database with a corrupted row-compressed record. It returns a database corruption error instead.³⁵
  Fixes an issue in which querying a database that contains a corrupted row-compressed record can return unintended memory content. SQL Server now returns a database corruption error message instead.

• Replication operations handle data validation problems correctly.³⁶
  Fixes an issue in replication operations that affects data validation.
• Merge Replication Web Synchronization handles a data validation problem.³⁷
  Addresses an issue in Merge Replication Web Synchronization operations that affects data validation.
• Queued replication command decoding no longer exposes information.⁴¹
  Fixes an information disclosure issue in queued replication command decoding.
• The changes introduced by the queued replication hotfix are rolled back.⁴²
  Rolls back the changes that were introduced by the queued replication hotfix.
• The changes introduced by the queued replication hotfix are rolled back.⁴³
  Rolls back the changes that were introduced by the queued replication hotfix.
• Replication queue parameter checks reject boundary strings that exceed the WCHAR conversion buffer.⁴⁴
  Fixes replication queue parameter validation to reject boundary strings that exceed the WCHAR conversion buffer.
• Replication queue parameter checks reject boundary strings that exceed the WCHAR conversion buffer.⁴⁵
  Fixes replication queue parameter validation to reject boundary strings that exceed the WCHAR conversion buffer.
• A vulnerability in replication queue command decoding is fixed.⁴⁶
  Fixes an information disclosure vulnerability in replication queue command decoding.
• The Log Reader Agent no longer has a heap buffer overflow.⁴⁷
  Fixes a heap buffer overflow that can occur in the Log Reader Agent.
• Merge replication rejects batch separators in subscriber validation expressions to fix an elevation of privilege vulnerability.⁴⁸
  Fixes an elevation of privilege vulnerability in SQL Server merge replication. Replication system procedures now reject batch separators in subscriber validation expressions.

For: SQL Server administrators on Windows

• A heap over-read no longer occurs when the Integration Services SQL task processes OLE DB output parameters.³⁸
  Fixes a heap over-read action that occurs if the SQL task in SQL Server Integration Services processes OLE DB output parameters.
• An integer overflow no longer causes memory access problems in the Integration Services HTTP connection manager.³⁹
  Fixes an integer overflow that can cause memory access issues in the HTTP connection manager of SQL Server Integration Services.
• Using the Integration Services Raw File source no longer causes a memory access violation.⁴⁰
  Fixes a memory access violation that might occur when you use the Raw File source component of SQL Server Integration Services.