KB5132746: Security update for SQL Server 2017, CU branch, November 2026. Database and replication flaws fixed; XSLT scripting disabled

For: Linux and Windows

• Some client connection requests could make SQL Server read memory outside the intended area. This is fixed.¹
  Fixes an out-of-bounds memory read during processing of certain client connection requests.

For: Linux and Windows

• A specially made event file could expose information or stop the database engine. This is fixed.²
  Resolves vulnerabilities that allow information disclosure or denial of service when the SQL Database Engine reads a specially crafted Extended Events (.xel) file.

For: Linux and Windows

• A specially made trace file could expose information or stop the database engine. This is fixed.³
  Fixes a security vulnerability that allows information disclosure or denial of service if the SQL Database Engine reads a specially crafted SQL Trace file.
• Some XML operations could damage data in memory. This is fixed.⁴
  Fixes a heap buffer overflow during XML operations.

For: Windows

• Processing some distributed transactions could damage memory. This is fixed.⁵
  Fixes a memory corruption issue in XA distributed transaction processing.

For: Windows

• Reading some database log records could access memory outside the intended area. This is fixed.⁶
  Fixes an out-of-bounds read in log block record parsing.

For: Windows

• A query on a database with a damaged row could show unintended memory content. It now returns a database corruption error instead.⁷
  Fixes queries that could return unintended memory content when a database contains a corrupted row-compressed record; SQL Server now returns a database corruption error message.

• A data-checking problem during replication operations is fixed.⁸
  Fixes an issue in replication operations that affects data validation.
• A data-checking problem during Merge Replication Web Synchronization is addressed.⁹
  Addresses an issue in Merge Replication Web Synchronization operations that affects data validation.
• A problem that could expose information while queued replication commands are read is fixed.¹⁰
  Fixes an information disclosure issue in queued replication command decoding.
• Replication queue checks now reject strings that exceed the allowed limit.¹⁴
  Fixes replication queue parameter validation to reject boundary strings that exceed the WCHAR conversion buffer.
• Replication queue checks now reject strings that exceed the allowed limit.¹⁵
  Fixes replication queue parameter validation to reject boundary strings that exceed the WCHAR conversion buffer.
• A problem that could expose information when replication queue commands are read is fixed.¹⁶
  Fixes an information disclosure vulnerability in replication queue command decoding.
• The Log Reader Agent could use more memory than intended. This is fixed.¹⁷
  Fixes a heap buffer overflow that can occur in the Log Reader Agent.
• A security flaw in merge replication is fixed. Replication procedures now reject certain invalid subscriber checks.¹⁸
  Fixes an elevation of privilege vulnerability in SQL Server merge replication. Replication system procedures now reject batch separators in subscriber validation expressions.

For: Windows

• Processing some OLE DB output values could read too much memory. This is fixed.¹¹
  Fixes a heap over-read if the SQL task in SQL Server Integration Services processes OLE DB output parameters.
• The HTTP Connection Manager could run into memory access problems when a number became too large. This is fixed.¹²
  Fixes an integer overflow that can cause memory access issues in the HTTP Connection Manager in SQL Server Integration Services.
• Using the Raw File source could cause a memory access error. This is fixed.¹³
  Fixes a memory access violation that might occur when you use the Raw File source component of SQL Server Integration Services.

For: Windows

• Security checks for database index operations are stronger.¹⁹
  Improves security for index operations in SQL Server.
• Security checks for database transaction logs are stronger.²⁰
  Improves security for transaction logging in SQL Server.
• Checks on the positions of changing-length data are better when database records are processed.²³
  Improves validation of variable-length column offsets if SQL Server processes database records.
• Checks on information that describes the database are stronger.²⁴
  Strengthens database metadata validation in SQL Server.

For: Windows

• Checks on sparse column data are stronger, helping protect data and reliability.²¹
  Improves validation of sparse column data in SQL Server to enhance security and reliability.

For: Windows

• Checks on columnstore data are stronger.²²
  Strengthens validation of columnstore data in SQL Server.

• Checks on access to some replication-related database operations are stronger, helping prevent unwanted disclosure of database information.²⁵
  Strengthens authorization checks for certain replication-related database operations to prevent unintended disclosure of database information.
• Replication security data is handled more safely when a subscription database is restored or upgraded.²⁷
  Improves the security and reliability of replication security metadata handling during subscription database restore and upgrade operations.
• The Log Reader Agent is more secure and reliable in some replication setups.²⁸
  Improves the security and reliability of the Log Reader Agent in heterogeneous transactional replication scenarios.
• Checks on column positions in replication data are better.³⁰
  Improves validation of column ordinals in replication rowsets.
• Security checks for replication during database upgrades are stronger.³¹
  Strengthens security validation for replication during database upgrades.
• Checks on conflict table names in transactional replication are better.³²
  Improves the validation of conflict table names for transactional replication.
• Merge replication tools handle column names better.³³
  Improves the handling of column names in merge replication stored procedures.
• Checks on names used by transactional replication are better.³⁴
  Improves identifier validation for transactional replication.
• Merge replication handles conflict table names better.³⁵
  Improves the handling of conflict table names in merge replication.
• Security checks for merge replication conflict reports are stronger.³⁶
  Strengthens security validation for conflict reporting in merge replication.
• Checks on object names used for merge replication changes are better.³⁷
  Improves the validation of object names for schema changes in merge replication.
• Merge replication handles table names in its generated procedures better.³⁸
  Improves the handling of table names in the generated procedures for merge replication.
• Checks on data used during merge replication changes are stronger.³⁹
  Strengthens input validation for change processing in merge replication.
• Transactional replication handles database structure changes more securely.⁴⁰
  Improves security if transactional replication processes schema changes.
• Security checks for lightweight merge replication operations are stronger.⁴¹
  Strengthens security checks for lightweight merge replication operations.
• Security checks on queued replication data are stronger.⁴²
  Improves security validation for the processing of queued replication data.
• Replication data and operations get stronger protection.⁴³
  Improves the protection of replication data and operations.
• Changes from an earlier queued replication hotfix are rolled back.⁴⁵
  Rolls back the changes that were introduced by the queued replication hotfix.
• Changes from an earlier queued replication hotfix are rolled back.⁴⁶
  Rolls back the changes that were introduced by the queued replication hotfix.
• Merge replication checks the source of errors more safely.⁴⁷
  Improves Merge Replication error-source parsing by adding bounded validation.
• Security checks for access to linked servers through replication are stronger.⁴⁸
  Strengthens security checks for linked server access in replication.

For: Linux and Windows

• Internal database tools handle object names better.²⁶
  Improves the handling of object names in internal stored procedures.

For: Windows

• SQLDiag handles long database names and names with Unicode characters better.²⁹
  Improves the handling of database names in SQLdiag for long names and names that contain Unicode characters.

For: Windows

• XSLT scripting is turned off by default. You can restore the previous behavior by setting EnableXsltScript to 1 at the specified registry path.⁴⁴
  Disables XSLT scripting by default. To restore previous behavior, set EnableXsltScript to 1 under HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\{version}\SSIS\XMLTask.