KB5132749: Security update for SQL Server 2017, GDR branch, November 2026. Replication flaws fixed; XSLT scripting disabled by default

For: Windows SQL Server administrators

• Index operations have stronger security checks.¹
  Improves security for index operations in SQL Server.
• Transaction logging has stronger security.²
  Improves security for transaction logging in SQL Server.
• SQL Server checks variable-length column positions more carefully when processing database records.⁵
  Improves validation of variable-length column offsets when SQL Server processes database records.
• Database metadata receives stronger checks.⁶
  Strengthens database metadata validation in SQL Server.

For: Windows SQL Server administrators

• Sparse column data receives stronger checks for security and reliability.³
  Improves validation of sparse column data in SQL Server to enhance security and reliability.

For: Windows SQL Server administrators

• Transaction logging has stronger security.⁴
  Improves security for transaction logging in SQL Server.

• Some replication database operations have stronger permission checks to help prevent unintended data disclosure.⁷
  Strengthens authorization checks for certain replication-related database operations to prevent unintended disclosure of database information.
• Replication security details are handled more safely when a subscription database is restored or upgraded.⁹
  Improves the security and reliability of replication security metadata handling during subscription database restore and upgrade operations.
• The Log Reader Agent is more secure and reliable in some replication setups.¹⁰
  Improves the security and reliability of the Log Reader Agent in heterogeneous transactional replication scenarios.
• Replication rowsets check column positions more carefully.¹²
  Improves validation of column ordinals in replication rowsets.
• Replication has stronger security checks during database upgrades.¹³
  Strengthens security validation for replication during database upgrades.
• Transactional replication checks conflict table names more carefully.¹⁴
  Improves validation of conflict table names for transactional replication.
• Merge replication stored procedures handle column names better.¹⁵
  Improves the handling of column names in merge replication stored procedures.
• Transactional replication checks identifiers more carefully.¹⁶
  Improves identifier validation for transactional replication.
• Merge replication handles conflict table names better.¹⁷
  Improves the handling of conflict table names in merge replication.
• Merge replication checks conflict reports more securely.¹⁸
  Strengthens security validation for conflict reporting in merge replication.
• Merge replication checks object names for schema changes more carefully.¹⁹
  Improves validation of object names for schema changes in merge replication.
• Generated merge replication procedures handle table names better.²⁰
  Improves the handling of table names in the generated procedures for merge replication.
• Merge replication checks change processing input more carefully.²¹
  Strengthens input validation for change processing in merge replication.
• Transactional replication handles schema changes more securely.²²
  Improves security if transactional replication processes schema changes.
• Lightweight merge replication operations have stronger security checks.²³
  Strengthens security checks for lightweight merge replication operations.
• Queued replication data receives stronger security checks.²⁴
  Improves security validation for the processing of queued replication data.
• Replication data and operations receive better protection.²⁵
  Improves the protection of replication data and operations.
• The changes from a queued replication hotfix are rolled back.²⁷
  Rolls back the changes that were introduced by the queued replication hotfix.
• The changes from a queued replication hotfix are rolled back.²⁸
  Rolls back the changes that were introduced by the queued replication hotfix.
• Merge replication checks error sources with limits to prevent unsafe parsing.²⁹
  Improves Merge Replication error-source parsing by adding bounded validation.
• Replication checks linked server access more securely.³⁰
  Strengthens security checks for linked server access in replication.

• Internal stored procedures handle object names better.⁸
  Improves the handling of object names in internal stored procedures.

For: Windows SQL Server administrators

• SQLDiag handles long database names and names with Unicode characters better.¹¹
  Improves database name handling in SQLdiag for long names and names that contain Unicode characters.

For: Windows SQL Server administrators

• XSLT scripting is off by default. Administrators can restore the previous behavior with a setting.²⁶
  Disables XSLT scripting by default. To restore previous behavior, set EnableXsltScript to 1 under HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\{version}\SSIS\XMLTask.

• Some client connection requests no longer cause an unsafe memory read.³¹
  Fixes an out-of-bounds memory read during processing of certain client connection requests.

• A specially made event file can no longer expose information or cause a service denial.³²
  Fixes vulnerabilities triggered when the SQL Database Engine reads a specially crafted Extended Events (.xel) file.

• A specially made trace file can no longer expose information or cause a service denial.³³
  Fixes a vulnerability triggered when the SQL Database Engine reads a specially crafted SQL Trace file.
• An XML operation no longer causes a heap buffer overflow.³⁴
  Fixes a heap buffer overflow during XML operation.

For: Windows SQL Server administrators

• Reading log block records no longer reads memory outside the intended area.³⁵
  Fixes an out-of-bounds read in log block record parsing.

For: Windows SQL Server administrators

• A query on a database with a damaged compressed row now reports database corruption instead of returning unintended memory content.³⁶
  Fixes querying a database that contains a corrupted row-compressed record; SQL Server now returns a database corruption error message.

• A data validation problem in replication operations is fixed.³⁷
  Fixes an issue in replication operations that affects data validation.
• A data validation problem in Merge Replication Web Synchronization is addressed.³⁸
  Addresses an issue affecting data validation in Merge Replication Web Synchronization operations.
• Queued replication command decoding no longer exposes information.³⁹
  Fixes an information disclosure issue in queued replication command decoding.
• Replication queue parameters reject boundary strings that are too long for conversion.⁴³
  Fixes replication queue parameter validation to reject boundary strings that exceed the WCHAR conversion buffer.
• Replication queue parameters reject boundary strings that are too long for conversion.⁴⁴
  Fixes replication queue parameter validation to reject boundary strings that exceed the WCHAR conversion buffer.
• Replication queue command decoding no longer exposes information.⁴⁵
  Fixes an information disclosure vulnerability in replication queue command decoding.
• The Log Reader Agent no longer risks a heap buffer overflow.⁴⁶
  Fixes a heap buffer overflow that can occur in the Log Reader Agent.
• Merge replication blocks batch separators in subscriber validation expressions to prevent unauthorized access.⁴⁷
  Fixes an elevation of privilege vulnerability in SQL Server merge replication. Replication system procedures now reject batch separators in subscriber validation expressions.

For: Windows SQL Server administrators

• Processing OLE DB output parameters with an Integration Services SQL task no longer reads beyond the buffer.⁴⁰
  Fixes a heap over-read when the SQL task in SQL Server Integration Services processes OLE DB output parameters.
• An HTTP connection no longer risks memory access problems from an integer overflow.⁴¹
  Fixes an integer overflow that can cause memory access issues in the HTTP connection manager of SQL Server Integration Services.
• Using the Raw File source no longer risks a memory access error.⁴²
  Fixes a memory access violation that might occur when using the Raw File source component of SQL Server Integration Services.