KB5132748: Security update for SQL Server 2025, GDR branch, November 2026. Replication and database data-handling flaws fixed

For: Windows

• XSLT scripting is off by default. You can restore the previous behavior with a setting.¹
  Disables XSLT scripting by default. To restore previous behavior, set EnableXsltScript to 1 under HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\{version}\SSIS\XMLTask.

• Merge replication checks names more carefully.²
  Improves identifier validation for merge replication.
• Transactional replication checks names more carefully.³
  Improves identifier validation for transactional replication.
• Replication data is handled more safely when a subscriber database is restored or upgraded.¹⁰
  Improves security and reliability of replication security metadata handling during subscriber database restore and upgrade operations.
• The Log Reader Agent handles data more safely in replication between different database systems.¹¹
  Improves the security and reliability of the Log Reader Agent in heterogeneous transactional replication scenarios.
• Change feed settings are handled more safely and reliably.¹²
  Improves the security and reliability of the change feed configuration.
• Access checks are stronger for certain replication tasks, helping prevent unintended disclosure of database information.¹³
  Strengthens authorization checks for certain replication-related database operations to prevent unintended disclosure of database information.
• Security checks are stronger for stored procedures used by merge replication.¹⁴
  Strengthens security validation for stored procedures used by merge replication.
• Replication checks transaction details more carefully.¹⁵
  Improves input validation for transaction identifiers processed by replication.
• Replication handles transaction details with improved memory safety.¹⁶
  Improves memory safety when replication processes transaction identifiers.
• Security checks are stronger when replication data is upgraded.¹⁹
  Strengthens security validation for replication during database upgrades.
• Transactional replication checks conflict table names more carefully.²⁰
  Improves validation of conflict table names for transactional replication.
• The Queue Reader Agent checks its settings more carefully.²¹
  Improves parameter validation for the Queue Reader Agent.
• Merge replication handles conflict table names more reliably.²²
  Improves the handling of conflict table names in merge replication.
• Security checks are stronger when merge replication reports conflicts.²³
  Strengthens security validation for conflict reporting in merge replication.
• Merge replication checks object names more carefully when database structures change.²⁴
  Improves validation of object names for schema changes in merge replication.
• Merge replication handles names in its generated procedures more reliably.²⁵
  Improves the handling of table names in generated procedures for merge replication.
• Merge replication checks incoming changes more carefully.²⁶
  Strengthens input validation for change processing in merge replication.
• Security checks are stronger when transactional replication processes database changes.²⁷
  Improves security when transactional replication processes schema changes.
• Security checks are stronger for lightweight merge replication tasks.²⁸
  Strengthens security checks for lightweight merge replication operations.
• Security checks are stronger when replication handles stored data waiting to be processed.²⁹
  Improves security validation for processing of queued replication data.
• Replication checks user roles more carefully when validating subscriptions.³¹
  Strengthens role validation for replication subscription checks.
• Replication data and tasks receive better protection.³²
  Improves the protection of replication data and operations.
• Security checks are stronger when replication connects to another server.³⁴
  Strengthens security checks for linked server access in replication.
• Input checks are stronger when SQL Server links data to Azure Synapse.³⁵
  Improves input validation for Azure Synapse Link for SQL.
• Merge replication checks error details more carefully.³⁶
  Improves Merge Replication error-source parsing by adding bounded validation.

For: Windows

• Security checks for database index operations are stronger.⁴
  Improves security for index operations in SQL Server.
• Security checks for transaction logging are stronger.⁵
  Improves security for transaction logging in SQL Server.
• SQL Server checks database records more carefully when handling columns with varying data lengths.⁸
  Improves validation of variable-length column offsets when processing database records.

For: Windows

• SQL Server checks certain database data more carefully to improve safety and reliability.⁶
  Improves validation of sparse column data in SQL Server to enhance security and reliability.

For: Windows

• Security checks for transaction logging are stronger.⁷
  Improves security for transaction logging in SQL Server.

For: Windows

• SQL Server checks database details more carefully during backup and restore tasks.⁹
  Improves database metadata validation in SQL Server.

• Internal database tools handle object names more reliably.¹⁷
  Improves the handling of object names in internal stored procedures.
• SQL Server checks access rights more carefully for Agent job steps.³⁰
  Improves authorization validation for SQL Server Agent job steps.

For: Windows

• The diagnostics tool handles long database names and names with characters from different writing systems more reliably.¹⁸
  Improves handling of database names in SQLdiag for long names and names containing Unicode characters.

For: Linux and Windows

• PolyBase checks incoming instructions more carefully.³³
  Improves input validation for PolyBase stored procedures.

For: Windows

• Connection requests are handled more safely, reducing a flaw that could affect memory access.³⁷
  Fixes an out-of-bounds memory read during processing of certain client connection requests.

For: Linux and Windows

• Permissions are cleaned up when external model objects are removed.³⁸
  Fixes incorrect cleanup of permissions when EXTERNAL MODEL objects are dropped.

For: Windows

• Processing certain database task outputs no longer risks memory access problems.³⁹
  Fixes a memory access issue when the SQL task processes truncated OLE DB output parameters.
• The HTTP connection tool no longer risks memory problems caused by number overflow.⁴⁰
  Fixes an integer overflow that can cause memory access issues in the HTTP connection manager.
• Using the Raw File source no longer risks a memory access crash.⁴¹
  Fixes a memory access violation that might occur when using the Raw File source component.

• XML operations no longer risk damaging nearby memory.⁴²
  Fixes a heap buffer overflow during XML operation.
• Creating a JSON index with an extremely long path returns an error instead of risking data damage.⁴⁴
  Fixes a problem where creating a JSON index with an excessively long path can cause memory corruption.
• JSON functions return an error instead of crashing when a path has more than 128 levels.⁴⁵
  Fixes an access violation when JSON functions process a path with more than 128 nesting levels.
• Combining JSON arrays no longer risks damaging data or creating an unexpected server dump.⁴⁶
  Fixes data corruption or an unexpected SQL Server dump file when merging JSON array data.
• A conversion error no longer risks showing unintended memory content.⁴⁷
  Fixes unintended memory content in a JSON_VALUE conversion error when used with RETURNING and multibyte UTF-8 input.
• Reading a specially crafted trace file no longer risks exposing information or stopping the service.⁵⁴
  Fixes a security vulnerability that allows information disclosure or a denial of service if the SQL Database Engine reads a specially crafted SQL Trace file.
• Checking certain tables no longer risks a crash when they contain a saved calculation based on JSON data.⁵⁵
  Fixes an access violation when DBCC CHECKTABLE or DBCC CHECKDB checks a table with a PERSISTED computed column based on a native json column.

For: Windows

• Processing distributed transactions no longer risks damaging memory.⁴³
  Fixes a memory corruption issue in XA distributed transaction processing.

For: Windows

• SQL Server handles certain log data more safely, reducing the risk of reading memory it should not access.⁴⁸
  Fixes an out-of-bounds read in log block record parsing.

For: Windows

• A query on a damaged database record returns a corruption error instead of unintended memory content.⁴⁹
  Fixes unintended memory content being returned when querying a database with a corrupted row-compressed record.

• Merge replication no longer risks a buffer overflow when processing more than 250 WebSync XML entries.⁵⁰
  Fixes a buffer overflow when merge replication processes more than 250 WebSync XML nickname entries.
• A problem affecting data checks during replication is addressed.⁵¹
  Addresses an issue in replication operations that affects data validation.
• A problem affecting data checks during merge replication over the web is addressed.⁵²
  Addresses an issue in Merge Replication Web Synchronization operations that affects data validation.
• A problem processing incoming change events is addressed.⁵³
  Addresses an issue in Change Event Streaming input data processing.
• Malformed replication details no longer risk making the Log Reader Agent use invalid data.⁵⁶
  Fixes malformed replication article metadata with missing or sparse column ordinals that can cause the Log Reader Agent to access invalid rowset bindings.
• A flaw that could expose information while processing replication commands is fixed.⁵⁷
  Fixes an information disclosure vulnerability in replication queue command decoding in xp_decodequeuecmd.
• The Log Reader Agent no longer risks a buffer overflow.⁵⁸
  Fixes a heap buffer overflow that can occur in the Log Reader Agent.
• A security flaw in merge replication is fixed by rejecting unsafe subscriber checks.⁵⁹
  Fixes an elevation of privilege vulnerability in SQL Server merge replication. Replication system procedures now reject batch separators in subscriber validation expressions.