Skip to the content
The Update Bureau
SQL Server 2019 GDR SQL Server 2019 GDR Security update
Patch Tuesday

KB5132751

KB5132751: Security update for SQL Server 2019, GDR branch, November 2026. Replication and Integration Services flaws fixed

In short

SQL Server 2019 gets fixes for security flaws and data-handling errors across replication, the database engine, and Integration Services.

Does it affect you? Applies to: Supported x64-based installations of SQL Server 2019, including installations with a SQL Server 2019 GDR release. The package is for x64; the listed Linux platforms for some fixes do not establish that this package applies to Linux.

Build
15.0.2210.4
Servicing branch
GDR
Security
50 fixed
Restart
Required

For servers on the GDR branch: they get security fixes only. Servers that install cumulative updates (CU branch) get a separate update. Which branch am I on?

What changes

Fixes 20 changes

SQL Connectivity

  • A memory read error during some client connection requests is fixed.1
    Fixes an out-of-bounds memory read action that can occur during processing of certain client connection requests. Bug reference 5270204.

Replication

10 items
  • A data disclosure problem when decoding queued replication commands is fixed.2
    Fixes an information disclosure issue in queued replication command decoding. Bug reference 5489597.
  • A data validation problem in replication operations is fixed.9
    Fixes an issue in replication operations that affects data validation. Bug reference 5639366.
  • A data validation problem in Merge Replication Web Synchronization is addressed.10
    Addresses an issue in Merge Replication Web Synchronization operations that affects data validation. Bug reference 5639379.
  • Changes from the queued replication hotfix are rolled back.14
    Rolls back the changes that were introduced by the queued replication hotfix. Bug reference 5699968.
  • Changes from the queued replication hotfix are rolled back.15
    Rolls back the changes that were introduced by the queued replication hotfix. Bug reference 5699969.
  • Replication queue checks now reject boundary strings that are too long for the conversion buffer.16
    Fixes replication queue parameter validation to reject boundary strings that exceed the WCHAR conversion buffer. Bug reference 5723093.
  • Replication queue checks now reject boundary strings that are too long for the conversion buffer.17
    Fixes replication queue parameter validation to reject boundary strings that exceed the WCHAR conversion buffer. Bug reference 5723098.
  • An information disclosure flaw in replication queue command decoding is fixed.18
    Fixes an information disclosure vulnerability in replication queue command decoding. Bug reference 5723128.
  • A memory buffer overflow that could occur in the Log Reader Agent is fixed.19
    Fixes a heap buffer overflow that can occur in the Log Reader Agent. Bug reference 5723280.
  • A merge replication flaw that could allow higher access is fixed.20
    Fixes an elevation of privilege vulnerability in SQL Server merge replication. Replication system procedures now reject batch separators in subscriber validation expressions. Bug reference 5731765.

Extended Events

  • Reading a specially made Extended Events file no longer causes the listed data disclosure or service denial problems.3
    Resolves several security vulnerabilities that allow information disclosure or a denial of service if the SQL Database Engine reads a specially crafted Extended Events (.xel) file. Bug reference 5500062.

Programmability

2 items
  • A security problem when the database engine reads a specially made SQL Trace file is fixed.4
    Fixes a security vulnerability that allows information disclosure or a denial of service if the SQL Database Engine reads a specially crafted SQL Trace file. Bug reference 5572854.
  • An XML operation that could overflow a memory buffer is fixed.5
    Fixes a heap buffer overflow during XML operation. Bug reference 5622182.

Transaction Services

  • A memory corruption problem in XA distributed transactions is fixed.6
    Fixes a memory corruption issue in XA distributed transaction processing. Bug reference 5622474.

Security Infrastructure

  • A memory read error while parsing log records is fixed.7
    Fixes an out-of-bounds read action in log block record parsing. Bug reference 5624093.

Access Methods

  • A query no longer returns unintended memory content from a corrupted compressed row. It returns a database corruption error instead.8
    Fixes an issue in which querying a database that contains a corrupted row-compressed record can return unintended memory content. SQL Server now returns a database corruption error message instead. Bug reference 5624561.

Integration Services

3 items
  • A memory over-read when an Integration Services SQL task handles OLE DB output parameters is fixed.11
    Fixes a heap over-read action that occurs if the SQL task in SQL Server Integration Services processes OLE DB output parameters. Bug reference 5657341.
  • An integer overflow that could cause memory access problems in the HTTP connection manager is fixed.12
    Fixes an integer overflow that can cause memory access issues in the HTTP connection manager of SQL Server Integration Services. Bug reference 5657963.
  • A possible memory access error when using the Raw File source is fixed.13
    Fixes a memory access violation that might occur when you use the Raw File source component of SQL Server Integration Services. Bug reference 5658158.

Improvements 27 changes

Methods to access stored data

4 items
  • Security checks for index operations are improved.21
    Improves security for index operations in SQL Server. Bug reference 5624547.
  • Security for transaction logging is improved.22
    Improves security for transaction logging in SQL Server. Bug reference 5624586.
  • Validation of variable-length column offsets is improved when database records are processed.25
    Improves the validation of variable-length column offsets if SQL Server processes database records. Bug reference 5624962.
  • Validation of database metadata is strengthened.26
    Strengthens database metadata validation in SQL Server. Bug reference 5624999.

Access Methods

  • Validation of sparse column data is improved for security and reliability.23
    Improves validation of sparse column data in SQL Server to enhance security and reliability. Bug reference 5624895.

Column Stores

  • Security for transaction logging is improved.24
    Improves security for transaction logging in SQL Server. Bug reference 5624932.

Replication

18 items
  • Authorization checks for some replication database operations are stronger, helping prevent unwanted disclosure of database information.27
    Strengthens authorization checks for certain replication-related database operations to prevent unintended disclosure of database information. Bug reference 5639398.
  • Replication security metadata is handled more securely and reliably when a subscription database is restored or upgraded.29
    Improves the security and reliability of the handling of replication security metadata during subscription database restore and upgrade operations. Bug reference 5644966.
  • The Log Reader Agent is more secure and reliable in heterogeneous transactional replication.30
    Improves the security and reliability of the Log Reader Agent in heterogeneous transactional replication scenarios. Bug reference 5645005.
  • Validation of column positions in replication rowsets is improved.32
    Improves validation of column ordinals in replication rowsets. Bug reference 5649972.
  • Security checks for replication during database upgrades are strengthened.33
    Strengthens security validation for replication during database upgrades. Bug reference 5653500.
  • Validation of conflict table names for transactional replication is improved.34
    Improves the validation of conflict table names for transactional replication. Bug reference 5653530.
  • Merge replication stored procedures handle column names better.35
    Improves the handling of column names in merge replication stored procedures. Bug reference 5653541.
  • Identifier checks for transactional replication are improved.36
    Improves identifier validation for transactional replication. Bug reference 5653583.
  • Merge replication handles conflict table names better.37
    Improves the handling of conflict table names in merge replication. Bug reference 5653599.
  • Security checks for conflict reporting in merge replication are stronger.38
    Strengthens security validation for conflict reporting in merge replication. Bug reference 5653632.
  • Generated merge replication procedures handle table names better.39
    Improves the handling of table names in the generated procedures for merge replication. Bug reference 5653712.
  • Input checks for change processing in merge replication are stronger.40
    Strengthens input validation for change processing in merge replication. Bug reference 5653728.
  • Security is improved when transactional replication processes schema changes.41
    Improves security if transactional replication processes schema changes. Bug reference 5653749.
  • Security checks for lightweight merge replication are stronger.42
    Strengthens security checks for lightweight merge replication operations. Bug reference 5653780.
  • Security checks for queued replication data are improved.43
    Improves security validation for the processing of queued replication data. Bug reference 5653813.
  • Replication data and operations receive stronger protection.44
    Improves the protection of replication data and operations. Bug reference 5654542.
  • Merge Replication error-source checks are more tightly limited and validated.46
    Improves Merge Replication error-source parsing by adding bounded validation. Bug reference 5723137.
  • Security checks for linked server access in replication are stronger.47
    Strengthens security checks for linked server access in replication. Bug reference 5725152.

Management Services

  • Internal stored procedures handle object names better.28
    Improves the handling of object names in internal stored procedures. Bug reference 5642392.

SQLDiag

  • SQLDiag handles long database names and names with Unicode characters better.31
    Improves the handling of database names in SQLdiag for long names and names that contain Unicode characters. Bug reference 5645702.

Integration Services

  • XSLT scripting is turned off by default. The previous behavior can be restored with a setting.45
    Disables XSLT scripting by default. To restore previous behavior, set EnableXsltScript to 1 under HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\{version}\SSIS\XMLTask. Bug reference 5656966.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-11-10
Classification
Security Updates
Type
Cumulative update
Servicing branch
GDR
Restart
Required
Replaces
KB5128495, KB5122773, KB5102336, KB5090408
+11 earlier KB5084817, KB5077470, KB5068405, KB5065223, KB5063758, KB5058713, KB5046859, KB5046056, KB5042214, KB5040986, KB5035434
VersionBuildChannel
2019 15.0.2210.4 General availability

Security

50 vulnerabilities fixed
48 important 2 not rated
VulnerabilitySeverityCVSS

The table lists the 0 exploited, publicly disclosed or critical vulnerabilities. See all 50 vulnerabilities →

Downloads (Microsoft Update Catalog)

Package 2019
514.3 MB
sqlserver2019-kb5132751-x64.exe Main update · KB5132751 SHA-1: f760daae…31bdec

Updated components

157 files changed since the previous update for the same versions.

Top changed componentsFiles
SQL Server Engine120
SQL Server PolyBase5

Page history

  1. Added CVE-2026-88089 (Important)

    Added CVE-2026-94512 (Important)

    Added CVE-2026-94520 (Important)

    Added CVE-2026-96956 (Important)

Sources

Updated
Cited passages from Microsoft's official notes (47)
  1. 1. Fixes an out-of-bounds memory read action that can occur during processing of certain client connection requests. support.microsoft.com
  2. 2. Fixes an information disclosure issue in queued replication command decoding. support.microsoft.com
  3. 3. Resolves several security vulnerabilities that allow information disclosure or a denial of service if the SQL Database Engine reads a specially crafted Extended Events (.xel) file. support.microsoft.com
  4. 4. Fixes a security vulnerability that allows information disclosure or a denial of service if the SQL Database Engine reads a specially crafted SQL Trace file. support.microsoft.com
  5. 5. Fixes a heap buffer overflow during XML operation. support.microsoft.com
  6. 6. Fixes a memory corruption issue in XA distributed transaction processing. support.microsoft.com
  7. 7. Fixes an out-of-bounds read action in log block record parsing. support.microsoft.com
  8. 8. Fixes an issue in which querying a database that contains a corrupted row-compressed record can return unintended memory content. SQL Server now returns a database corruption error message instead. support.microsoft.com
  9. 9. Fixes an issue in replication operations that affects data validation. support.microsoft.com
  10. 10. Addresses an issue in Merge Replication Web Synchronization operations that affects data validation. support.microsoft.com
  11. 11. Fixes a heap over-read action that occurs if the SQL task in SQL Server Integration Services processes OLE DB output parameters. support.microsoft.com
  12. 12. Fixes an integer overflow that can cause memory access issues in the HTTP connection manager of SQL Server Integration Services. support.microsoft.com
  13. 13. Fixes a memory access violation that might occur when you use the Raw File source component of SQL Server Integration Services. support.microsoft.com
  14. 14. Rolls back the changes that were introduced by the queued replication hotfix. support.microsoft.com
  15. 15. Rolls back the changes that were introduced by the queued replication hotfix. support.microsoft.com
  16. 16. Fixes replication queue parameter validation to reject boundary strings that exceed the WCHAR conversion buffer. support.microsoft.com
  17. 17. Fixes replication queue parameter validation to reject boundary strings that exceed the WCHAR conversion buffer. support.microsoft.com
  18. 18. Fixes an information disclosure vulnerability in replication queue command decoding. support.microsoft.com
  19. 19. Fixes a heap buffer overflow that can occur in the Log Reader Agent. support.microsoft.com
  20. 20. Fixes an elevation of privilege vulnerability in SQL Server merge replication. Replication system procedures now reject batch separators in subscriber validation expressions. support.microsoft.com
  21. 21. Improves security for index operations in SQL Server. support.microsoft.com
  22. 22. Improves security for transaction logging in SQL Server. support.microsoft.com
  23. 23. Improves validation of sparse column data in SQL Server to enhance security and reliability. support.microsoft.com
  24. 24. Improves security for transaction logging in SQL Server. support.microsoft.com
  25. 25. Improves the validation of variable-length column offsets if SQL Server processes database records. support.microsoft.com
  26. 26. Strengthens database metadata validation in SQL Server. support.microsoft.com
  27. 27. Strengthens authorization checks for certain replication-related database operations to prevent unintended disclosure of database information. support.microsoft.com
  28. 28. Improves the handling of object names in internal stored procedures. support.microsoft.com
  29. 29. Improves the security and reliability of the handling of replication security metadata during subscription database restore and upgrade operations. support.microsoft.com
  30. 30. Improves the security and reliability of the Log Reader Agent in heterogeneous transactional replication scenarios. support.microsoft.com
  31. 31. Improves the handling of database names in SQLdiag for long names and names that contain Unicode characters. support.microsoft.com
  32. 32. Improves validation of column ordinals in replication rowsets. support.microsoft.com
  33. 33. Strengthens security validation for replication during database upgrades. support.microsoft.com
  34. 34. Improves the validation of conflict table names for transactional replication. support.microsoft.com
  35. 35. Improves the handling of column names in merge replication stored procedures. support.microsoft.com
  36. 36. Improves identifier validation for transactional replication. support.microsoft.com
  37. 37. Improves the handling of conflict table names in merge replication. support.microsoft.com
  38. 38. Strengthens security validation for conflict reporting in merge replication. support.microsoft.com
  39. 39. Improves the handling of table names in the generated procedures for merge replication. support.microsoft.com
  40. 40. Strengthens input validation for change processing in merge replication. support.microsoft.com
  41. 41. Improves security if transactional replication processes schema changes. support.microsoft.com
  42. 42. Strengthens security checks for lightweight merge replication operations. support.microsoft.com
  43. 43. Improves security validation for the processing of queued replication data. support.microsoft.com
  44. 44. Improves the protection of replication data and operations. support.microsoft.com
  45. 45. Disables XSLT scripting by default. To restore previous behavior, set EnableXsltScript to 1 under HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\{version}\SSIS\XMLTask. support.microsoft.com
  46. 46. Improves Merge Replication error-source parsing by adding bounded validation. support.microsoft.com
  47. 47. Strengthens security checks for linked server access in replication. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 47 quoted passages · compared with Microsoft's page on Nov 15, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake