Microsoft has published SQL Server 2025 CU8 + GDR as KB5122769 for SQL Server 2025. The update is a security release for build 17.0.4085.5 and includes 47 fixes across the Database Engine and related components.

The release spans several practical areas, including SQL Server Agent, PolyBase, replication, Extended Events, backup and restore, Query Execution, XML, Query Store, programmability, and security infrastructure. Microsoft also lists multiple vulnerability-related fixes in the release notes.

Known issues

Microsoft documents two known issues in this release:

  • Linked server queries that use MSDASQL can fail with error 7416 when a provider string is specified. Microsoft says a stricter connection validation check can reject some linked server configurations that use the MSDASQL provider, even if earlier builds allowed them.
  • Queries against sys.dm_exec_requests can raise an access violation during database recovery and generate a dump file. Microsoft says this can happen during RESTORE, startup recovery, or before an availability group replica finishes coming online. Microsoft also says it is investigating a fix.

Improvements and fixes

This release includes 47 verified fixes. The changes are broad, but a few representative areas stand out:

  • SQL Server Agent and security validation: several fixes strengthen validation and reliability in SQL Server Agent when it loads task-agent components or processes specific input.
  • PolyBase: Microsoft improved validation of responses from S3-compatible external storage endpoints and addressed a case where modified command-line parameters could lead PolyBase services to open raw TCP listeners for DW Engine and DMS channels.
  • Replication: a large group of fixes improves identifier handling, parameter validation, metadata processing, OSF deserialization, Change Event Streaming behavior, and queued updating subscriptions.
  • Query Execution and programmability: fixes address input validation issues, buffer overflows, arithmetic overflow, and memory-access problems in areas such as LEFT_SHIFT, RIGHT_SHIFT, TDS RPC processing, and SqlDataRecord.SetBytes.
  • XML and Extended Events: Microsoft fixed XML handling issues in DTD attribute lists, OPENROWSET(BULK...)/BULK INSERT, and large OPTION (USE PLAN) XML declarations, along with Extended Events validation issues that could lead to memory corruption or other failures.
  • Backup and restore: the update tightens validation of backup metadata processed by the SQL Server VSS Writer and addresses an issue affecting managed backup stored procedures.
  • Security infrastructure and auditing: fixes cover Microsoft Entra authentication login handling and more consistent population of data_sensitivity_information in audit records.

Other fixes touch In-Memory OLTP, Query Store, WMI Management Provider (SqlMgmProvider), and XML parsing. Several entries are explicitly described as security or reliability improvements, while others correct specific validation, memory safety, or processing issues in engine components.

Official source