Microsoft has published Cumulative Update 9 (CU9) for SQL Server 2025, also known as KB5122048. The update moves SQL Server to build 17.0.5005.3 and includes 44 fixes issued after Cumulative Update 8.

The release also updates Analysis Services to 17.0.25.223. Microsoft groups the changes across engine, client tools, and service components, with a strong emphasis on security hardening, input validation, and reliability improvements.

Known issues

Microsoft lists three known issues with CU9:

  • SESSION_CONTEXT in parallel plans can return incorrect results or produce access violation dump files when used in parallel query plans, especially when a session is reset for reuse.
  • Linked server queries using MSDASQL and a provider string (@provstr) can fail with Msg 7416 about missing login mapping.
  • Querying sys.dm_exec_requests during database recovery can raise an access violation and generate a dump file while a database is still recovering.

For the recovery-related issue, Microsoft says it is investigating a fix and documents mitigations including trace flag 4696, avoiding those queries against recovering databases, or uninstalling the update. For the other two issues, Microsoft points to related known-issues articles. Removal from the source would not, by itself, prove a problem has been resolved.

Improvements and fixes

CU9 includes 44 fixes across several areas:

  • Security and validation: fixes and hardening changes for Entra authentication, enclave code, attestation parsing, SQL Server Agent, WMI Provider input handling, and several query optimizer validation paths.
  • Backup and restore: safer validation of VSS Writer backup metadata.
  • High availability and recovery: a fix for secondary replicas joining an availability group with a 64-character name and cluster type NONE or EXTERNAL.
  • In-Memory OLTP and programmability: fixes for malformed DBCS handling, _VSS collation scenarios, arithmetic overflow in LEFT_SHIFT and RIGHT_SHIFT, and SqlDataRecord.SetBytes field-offset validation.
  • PolyBase and external data access: improved response validation for S3-compatible endpoints and a fix for raw TCP listener exposure when PolyBase services are started with modified command-line parameters.
  • XML and bulk operations: fixes for DTD attribute list handling, OPTION (USE PLAN) XML declarations, and crafted XML format files processed through OPENROWSET(BULK ...) or BULK INSERT.
  • Replication and Change Event Streaming: improved protection and handling across replication features, plus fixes for CES event deserialization and dump files during large-object streaming.
  • Query Store and SQL OS: improved Showplan input handling and a fix for the Buffer cache hit ratio counter showing zero in Performance Monitor.
  • Storage and tempdb tracking: a fix for inconsistent tempdb space usage reported by sys.dm_db_session_space_usage after drop or truncate operations.

Representative fixes include a buffer overflow during authenticated TDS RPC, malformed input handling in the SQL Server WMI Provider, access violations in XML and Query Optimizer paths, and several replication reliability updates.

Release details

  • KB: KB5122048
  • Update: Cumulative Update 9 for Microsoft SQL Server 2025
  • Build: 17.0.5005.3
  • Analysis Services build: 17.0.25.223
  • Official release date: 2026-09-15

Official source