Skip to the content
The Update Bureau
SQL Server 2022 GDR SQL Server 2022 GDR Security update
Patch Tuesday

KB5132747

KB5132747: Security update for SQL Server 2022, GDR branch, November 2026. Database vulnerabilities addressed; replication checks strengthened

In short

Database security fixes address vulnerabilities, while changes improve replication checks and prevent unsafe memory access. The update can request a restart.

Does it affect you? Applies to: SQL Server 2022 installations on supported x64 systems, including installations on Windows or Linux. The update is optional on computers that do not host SQL Server Reporting Services.

Build
16.0.1220.3
Servicing branch
GDR
Security
54 fixed
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • Does it affect you? The page provides a supported x64 executable through Windows Update, the Microsoft Update Catalog, and the Download Center. Some individual fixes are marked for Linux and Windows, but the page does not identify a Linux installation package for this update.

The official sources are linked at the end of the page.

For servers on the GDR branch: they get security fixes only. Servers that install cumulative updates (CU branch) get a separate update. Which branch am I on?

What changes

Improvements 35 changes

Replication

24 items
  • Identifier checks for merge replication are improved.1
    Improves identifier validation for merge replication.
  • Identifier checks for transactional replication are improved.2
    Improves identifier validation for transactional replication.
  • Replication security metadata is handled more securely and reliably during subscriber database restores and upgrades.9
    Improves replication security metadata handling during subscriber database restore and upgrade operations.
  • The Log Reader Agent is more secure and reliable in heterogeneous transactional replication.10
    Improves the security and reliability of the Log Reader Agent in heterogeneous transactional replication scenarios.
  • Change feed configuration handling is more secure and reliable.11
    Improves the security and reliability of the change feed configuration.
  • Authorization checks for some replication database operations are stronger, helping prevent unintended disclosure of database information.12
    Strengthens authorization checks for certain replication-related database operations to prevent unintended disclosure of database information.
  • Checks for transaction identifiers handled by replication are improved.13
    Improves input validation for transaction identifiers that replication processes.
  • Memory safety is improved when replication handles transaction identifiers.14
    Improves memory safety if replication processes transaction identifiers.
  • Replication security checks during database upgrades are strengthened.17
    Strengthens security validation for replication during database upgrades.
  • Checks for conflict table names in transactional replication are improved.18
    Improves the validation of conflict table names for transactional replication.
  • The Queue Reader Agent checks its parameters more carefully.19
    Improves parameter validation for the Queue Reader Agent.
  • Merge replication handles conflict table names better.20
    Improves the handling of conflict table names in merge replication.
  • Security checks for conflict reporting in merge replication are stronger.21
    Strengthens security validation for conflict reporting in merge replication.
  • Checks for object names during merge replication schema changes are improved.22
    Improves the validation of object names for schema changes in merge replication.
  • Generated merge replication procedures handle table names better.23
    Improves the handling of table names in the generated procedures for merge replication.
  • Checks for changes processed by merge replication are strengthened.24
    Strengthens input validation for change processing in merge replication.
  • Transactional replication has improved security checks when processing schema changes.25
    Improves security if transactional replication processes schema changes.
  • Security checks for lightweight merge replication operations are strengthened.26
    Strengthens security checks for lightweight merge replication operations.
  • Security checks for queued replication data are improved.27
    Improves security validation for the processing of queued replication data.
  • Role checks for replication subscriptions are strengthened.29
    Strengthens role validation for replication subscription checks.
  • Replication data and operations receive stronger protection.30
    Improves the protection of replication data and operations.
  • Security checks for linked server access in replication are strengthened.33
    Strengthens security checks for linked server access in replication.
  • Input checks for Azure Synapse Link for SQL are improved.34
    Improves input validation for Azure Synapse Link for SQL.
  • Merge Replication error-source parsing now uses bounded checks.35
    Improves Merge Replication error-source parsing by adding bounded validation.

Methods to access stored data

4 items
  • Index operations have improved security checks.3
    Improves security for index operations in SQL Server.
  • Transaction logging has improved security checks.4
    Improves security for transaction logging in SQL Server.
  • Checks for variable-length column offsets are improved when database records are processed.7
    Improves the validation of variable-length column offsets if SQL Server processes database records.
  • Database metadata checks are strengthened.8
    Strengthens database metadata validation in SQL Server.

Access Methods

  • Checks for sparse column data are improved to support security and reliability.5
    Improves validation of sparse column data in SQL Server to enhance security and reliability.

Column Stores

  • Transaction logging has improved security checks.6
    Improves security for transaction logging in SQL Server.

Management Services

2 items
  • Internal stored procedures handle object names better.15
    Improves the handling of object names in internal stored procedures.
  • Authorization checks for SQL Server Agent job steps are improved.28
    Improves authorization validation for SQL Server Agent job steps.

SQLDiag

  • SQLdiag handles long database names and names with Unicode characters better.16
    Improves the handling of database names in SQLdiag for long names and names that contain Unicode characters.

Integration Services

  • XSLT scripting is off by default. You can restore the previous behavior with a setting.31
    Disables XSLT scripting by default. To restore previous behavior, set EnableXsltScript to 1 under HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\{version}\SSIS\XMLTask.

PolyBase

  • Input checks for PolyBase stored procedures are improved.32
    Improves input validation for PolyBase stored procedures.

Fixes 17 changes

SQL Connectivity

  • Some client connection requests no longer cause an out-of-bounds memory read.36
    Fixes an out-of-bounds memory read during processing of certain client connection requests.

Programmability

2 items
  • An XML operation no longer causes a heap buffer overflow.37
    Fixes a heap buffer overflow during XML operation.
  • A security flaw that could expose information or cause a denial of service when reading a specially crafted SQL Trace file is fixed.45
    Fixes a security vulnerability that allows information disclosure or a denial of service if the SQL Database Engine reads a specially crafted SQL Trace file.

Transaction Services

  • A memory corruption issue in XA distributed transaction processing is fixed.38
    Fixes a memory corruption issue in XA distributed transaction processing.

Security Infrastructure

  • An out-of-bounds read in log block record parsing is fixed.39
    Fixes an out-of-bounds read action in log block record parsing.

Access Methods

  • A query no longer returns unintended memory content from a corrupted row-compressed record. SQL Server returns a database corruption error instead.40
    Fixes unintended memory disclosure when querying a database that contains a corrupted row-compressed record.

Replication

8 items
  • Merge replication no longer causes a buffer overflow when processing more than 250 WebSync XML nickname entries.41
    Fixes a buffer overflow that occurs if merge replication processes more than 250 WebSync XML nickname entries.
  • An issue affecting data checks in replication operations is addressed.42
    Addresses an issue in replication operations that affects data validation.
  • An issue affecting data checks in Merge Replication Web Synchronization is addressed.43
    Addresses an issue in Merge Replication Web Synchronization operations that affects data validation.
  • An issue with replication checks and error handling is fixed to improve security and reliability.44
    Fixes an issue in replication validation and error handling to improve security and reliability.
  • Malformed replication article metadata no longer causes the Log Reader Agent to use invalid rowset bindings.49
    Fixes an issue in which malformed replication article metadata with missing or sparse column ordinals can cause the Log Reader Agent to access invalid rowset bindings.
  • An information disclosure vulnerability in replication queue command decoding is fixed.50
    Fixes an information disclosure vulnerability in replication queue command decoding in xp_decodequeuecmd.
  • A heap buffer overflow that can occur in the Log Reader Agent is fixed.51
    Fixes a heap buffer overflow that can occur in the Log Reader Agent.
  • A privilege escalation flaw in SQL Server merge replication is fixed. Replication system procedures reject batch separators in subscriber validation expressions.52
    Fixes an elevation of privilege vulnerability in SQL Server merge replication. Replication system procedures now reject batch separators in subscriber validation expressions.

Integration Services

3 items
  • The SQL task no longer causes a heap over-read when it processes OLE DB output parameters.46
    Fixes a heap over-read action that occurs if the SQL task in SQL Server Integration Services processes OLE DB output parameters.
  • An integer overflow in the HTTP connection manager that could cause memory access issues is fixed.47
    Fixes an integer overflow that can cause memory access issues in the HTTP connection manager of SQL Server Integration Services.
  • A memory access error that might occur with the Raw File source component is fixed.48
    Fixes a memory access violation that might occur when you use the Raw File source component of SQL Server Integration Services.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-11-10
Classification
Security Updates
Type
Cumulative update
Servicing branch
GDR
Restart
Required
Replaces
KB5128493, KB5122771, KB5102334, KB5091158
+13 earlier KB5084815, KB5077465, KB5073031, KB5068407, KB5065221, KB5063756, KB5058712, KB5046861, KB5046057, KB5042211, KB5040936, KB5035432, KB5032968
VersionBuildChannel
2022 16.0.1220.3 General availability

Security

54 vulnerabilities fixed
52 important 2 not rated
VulnerabilitySeverityCVSS

The table lists the 0 exploited, publicly disclosed or critical vulnerabilities. See all 54 vulnerabilities →

Downloads (Microsoft Update Catalog)

Package 2022
356.0 MB
sqlserver2022-kb5132747-x64.exe Main update · KB5132747 SHA-1: fa5268df…caac69

Updated components

142 files changed since the previous update for the same versions.

Top changed componentsFiles
SQL Server Engine111
SQL Server PolyBase2

Page history

  1. Added CVE-2026-83945 (Important)

    Added CVE-2026-88089 (Important)

    Added CVE-2026-94512 (Important)

    Added CVE-2026-94520 (Important)

    Added CVE-2026-96956 (Important)

Sources

Updated
Cited passages from Microsoft's official notes (52)
  1. 1. 5614001 | Improves identifier validation for merge replication. | SQL Server Engine | Replication | Windows | support.microsoft.com
  2. 2. 5622571 | Improves identifier validation for transactional replication. | SQL Server Engine | Replication | Windows | support.microsoft.com
  3. 3. 5624544 | Improves security for index operations in SQL Server. | SQL Server Engine | Methods to access stored data | Windows | support.microsoft.com
  4. 4. 5624578 | Improves security for transaction logging in SQL Server. | SQL Server Engine | Methods to access stored data | Windows | support.microsoft.com
  5. 5. 5624883 | Improves validation of sparse column data in SQL Server to enhance security and reliability. | SQL Server Engine | Access Methods | Windows | support.microsoft.com
  6. 6. 5624929 | Improves security for transaction logging in SQL Server. | SQL Server Engine | Column Stores | Windows | support.microsoft.com
  7. 7. 5624956 | Improves the validation of variable-length column offsets if SQL Server processes database records. | SQL Server Engine | Methods to access stored data | Windows | support.microsoft.com
  8. 8. 5624996 | Strengthens database metadata validation in SQL Server. | SQL Server Engine | Methods to access stored data | Windows | support.microsoft.com
  9. 9. 5632313 | Improves the security and reliability of replication security metadata handling during subscriber database restore and upgrade operations. | SQL Server Engine | Replication | Windows | support.microsoft.com
  10. 10. 5632801 | Improves the security and reliability of the Log Reader Agent in heterogeneous transactional replication scenarios. | SQL Server Engine | Replication | Windows | support.microsoft.com
  11. 11. 5632814 | Improves the security and reliability of the change feed configuration. | SQL Server Engine | Replication | Windows | support.microsoft.com
  12. 12. 5632928 | Strengthens authorization checks for certain replication-related database operations to prevent unintended disclosure of database information. | SQL Server Engine | Replication | Windows | support.microsoft.com
  13. 13. 5636098 | Improves input validation for transaction identifiers that replication processes. | SQL Server Engine | Replication | Linux, Windows | support.microsoft.com
  14. 14. 5636145 | Improves memory safety if replication processes transaction identifiers. | SQL Server Engine | Replication | Linux, Windows | support.microsoft.com
  15. 15. 5641944 | Improves the handling of object names in internal stored procedures. | SQL Server Engine | Management Services | Linux, Windows | support.microsoft.com
  16. 16. 5645716 | Improves the handling of database names in SQLdiag for long names and names that contain Unicode characters. | SQL Server Client Tools | SQLDiag | Windows | support.microsoft.com
  17. 17. 5653497 | Strengthens security validation for replication during database upgrades. | SQL Server Engine | Replication | Windows | support.microsoft.com
  18. 18. 5653526 | Improves the validation of conflict table names for transactional replication. | SQL Server Engine | Replication | Windows | support.microsoft.com
  19. 19. 5653573 | Improves parameter validation for the Queue Reader Agent. | SQL Server Engine | Replication | Windows | support.microsoft.com
  20. 20. 5653596 | Improves the handling of conflict table names in merge replication. | SQL Server Engine | Replication | Windows | support.microsoft.com
  21. 21. 5653629 | Strengthens security validation for conflict reporting in merge replication. | SQL Server Engine | Replication | Windows | support.microsoft.com
  22. 22. 5653684 | Improves the validation of object names for schema changes in merge replication. | SQL Server Engine | Replication | Windows | support.microsoft.com
  23. 23. 5653708 | Improves the handling of table names in the generated procedures for merge replication. | SQL Server Engine | Replication | Windows | support.microsoft.com
  24. 24. 5653721 | Strengthens input validation for change processing in merge replication. | SQL Server Engine | Replication | Windows | support.microsoft.com
  25. 25. 5653744 | Improves security if transactional replication processes schema changes. | SQL Server Engine | Replication | Windows | support.microsoft.com
  26. 26. 5653767 | Strengthens security checks for lightweight merge replication operations. | SQL Server Engine | Replication | Windows | support.microsoft.com
  27. 27. 5653809 | Improves security validation for the processing of queued replication data. | SQL Server Engine | Replication | Windows | support.microsoft.com
  28. 28. 5653824 | Improves authorization validation for SQL Server Agent job steps. | SQL Server Engine | Management Services | Windows | support.microsoft.com
  29. 29. 5653834 | Strengthens role validation for replication subscription checks. | SQL Server Engine | Replication | Windows | support.microsoft.com
  30. 30. 5654547 | Improves the protection of replication data and operations. | SQL Server Engine | Replication | Linux, Windows | support.microsoft.com
  31. 31. 5656898 | Disables XSLT scripting by default. To restore previous behavior, set EnableXsltScript to 1 under HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\{version}\SSIS\XMLTask. | Integration Services | Integration Services | Windows | support.microsoft.com
  32. 32. 5660609 | Improves input validation for PolyBase stored procedures. | SQL Server Engine | PolyBase | Windows | support.microsoft.com
  33. 33. 5720073 | Strengthens security checks for linked server access in replication. | SQL Server Engine | Replication | Linux, Windows | support.microsoft.com
  34. 34. 5720090 | Improves input validation for Azure Synapse Link for SQL. | SQL Server Engine | Replication | Linux, Windows | support.microsoft.com
  35. 35. 5723140 | Improves Merge Replication error-source parsing by adding bounded validation. | SQL Server Engine | Replication | Windows | support.microsoft.com
  36. 36. 5270201 | Fixes an out-of-bounds memory read action that can occur during processing of certain client connection requests. | SQL Connectivity | SQL Connectivity | Windows | support.microsoft.com
  37. 37. 5622180 | Fixes a heap buffer overflow during XML operation. | SQL Server Engine | Programmability | Linux, Windows | support.microsoft.com
  38. 38. 5622472 | Fixes a memory corruption issue in XA distributed transaction processing. | SQL Server Engine | Transaction Services | Windows | support.microsoft.com
  39. 39. 5624104 | Fixes an out-of-bounds read action in log block record parsing. | SQL Server Engine | Security Infrastructure | Windows | support.microsoft.com
  40. 40. 5624557 | Fixes an issue in which querying a database that contains a corrupted row-compressed record can return unintended memory content. SQL Server now returns a database corruption error message instead. | SQL Server Engine | Access Methods | Windows | support.microsoft.com
  41. 41. 5632849 | Fixes a buffer overflow that occurs if merge replication processes more than 250 WebSync XML nickname entries. | SQL Server Engine | Replication | Linux, Windows | support.microsoft.com
  42. 42. 5632875 | Addresses an issue in replication operations that affects data validation. | SQL Server Engine | Replication | Linux, Windows | support.microsoft.com
  43. 43. 5632888 | Addresses an issue in Merge Replication Web Synchronization operations that affects data validation. | SQL Server Engine | Replication | Linux, Windows | support.microsoft.com
  44. 44. 5635182 | Fixes an issue in replication validation and error handling to improve security and reliability. | SQL Server Engine | Replication | Windows | support.microsoft.com
  45. 45. 5635962 | Fixes a security vulnerability that allows information disclosure or a denial of service if the SQL Database Engine reads a specially crafted SQL Trace file. | SQL Server Engine | Programmability | Linux, Windows | support.microsoft.com
  46. 46. 5657242 | Fixes a heap over-read action that occurs if the SQL task in SQL Server Integration Services processes OLE DB output parameters. | Integration Services | Integration Services | Windows | support.microsoft.com
  47. 47. 5657881 | Fixes an integer overflow that can cause memory access issues in the HTTP connection manager of SQL Server Integration Services. | Integration Services | Integration Services | Windows | support.microsoft.com
  48. 48. 5658114 | Fixes a memory access violation that might occur when you use the Raw File source component of SQL Server Integration Services. | Integration Services | Integration Services | Windows | support.microsoft.com
  49. 49. 5722305 | Fixes an issue in which malformed replication article metadata with missing or sparse column ordinals can cause the Log Reader Agent to access invalid rowset bindings. | SQL Server Engine | Replication | Windows | support.microsoft.com
  50. 50. 5722310 | Fixes an information disclosure vulnerability in replication queue command decoding in xp_decodequeuecmd. | SQL Server Engine | Replication | Windows | support.microsoft.com
  51. 51. 5723300 | Fixes a heap buffer overflow that can occur in the Log Reader Agent. | SQL Server Engine | Replication | Windows | support.microsoft.com
  52. 52. 5731799 | Fixes an elevation of privilege vulnerability in SQL Server merge replication. Replication system procedures now reject batch separators in subscriber validation expressions. | SQL Server Engine | Replication | Windows | support.microsoft.com
Checked automatically: 7 of 8 checks passed, 52 quoted passages · compared with Microsoft's page on Nov 15, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake