IBM Db2
CVE-2024-47118
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Db2 database session on target instance
-
ExploitCraft malformed SQL query
-
ExecutionSubmit query to trigger stack buffer overflow (CWE-121)
-
ImpactDb2 server process crashes, denying service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the ability to submit a specially crafted SQL query to an affected Db2 LUW server (10.5.x, 11.1.x, 11.5.x, or 12.1.x, including Db2 Connect Server) on Linux, UNIX, or Windows, which in practice presupposes network reachability to the database listener and an established database session. The CVSS vector claims PR:N (no privileges), but query submission normally requires a valid authenticated Db2 connection, so credentialed access is a likely practical prerequisite that limits remote anonymous exploitation; no user interaction is required and the outcome is a server crash (availability only). Limiting factors: exposure is reduced where the Db2 instance is not reachable by untrusted clients and where query submission is restricted to authenticated, least-privilege accounts. |
| Impact | This is a network-facing denial-of-service flaw in IBM Db2 LUW rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with the entire score driven by availability impact (A:H) - there is no confidentiality or integrity exposure. Corroborating signals point to LOW real-world urgency rather than an emergency: EPSS is only 0.14% (34th percentile), the CVE is NOT on CISA KEV, and no public exploit code is identified, so there is no public exploit identified at time of analysis. The high CVSS is therefore a high-severity-but-low-current-risk case typical of availability-only bugs. One conflict should be flagged: the vector asserts PR:N (unauthenticated), yet the description requires submitting a 'specially crafted query,' which in practice requires an established Db2 database session and therefore valid credentials - CVSS indicates no privileges but the attack mechanism implies an authenticated database connection; verify the required privilege level with IBM. CWE-121 (stack-based buffer overflow) could in principle imply memory corruption beyond a crash, but IBM scored only A:H with C:N/I:N, indicating the realistic outcome is a server crash, not code execution. |
| Exploit ScenarioDerived | An attacker with the ability to submit SQL to a reachable Db2 instance (per the description's 'specially crafted query') sends a malformed query that overflows a stack buffer during parsing/processing, causing the Db2 server process to crash and interrupting all dependent applications. No public exploit code is identified, and because the impact is a crash rather than code execution, exploitation yields service disruption rather than data compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 02, 2026
A specially crafted SQL query can crash IBM Db2 for Linux, UNIX and Windows, including Db2 Connect Server, producing a denial of service in versions 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3. The issue is scored CVSS 7.5 with availability-only impact (C:N/I:N/A:H), and while the published vector claims PR:N, our independent assessment holds that submitting the malicious query in practice presupposes network reachability to the database listener and a valid authenticated Db2 session, so credentialed access is the likely prerequisite. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; EPSS is low at 0.14% (34th percentile), consistent with a targeted, availability-focused flaw in an enterprise database.
Earlier versions of this analysis (1)
IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
RemediationAI
The primary fix is to move off the affected release ranges listed in IBM's advisory at https://www.ibm.com/support/pages/node/7250473; no exact fix-pack version is confirmed in the available data, so obtain the applicable fixed build for your train (above 10.5.11, 11.1.4.7, 11.5.9, or 12.1.3 as documented by IBM) rather than assuming a specific level. Until the upgrade is applied, compensating controls should target the fact that exploit delivery requires a query to reach the Db2 engine: restrict network access to the Db2 listener port (default 50000) to known application subnets via firewall or host-based rules, which removes the exposure path but can break legitimate remote clients and distributed Db2 Connect topologies; enforce least-privilege, dedicated service accounts for query submission and revoke ad-hoc query access for untrusted users, which constrains who can trigger the crash but does not protect against a compromised application account; enable database monitoring and alerting on abnormal server termination and rapid connection churn so repeated crash attempts are detected quickly; and where available, apply workload/query timeouts or a resource governor to cap query complexity and cost, accepting that this may reject legitimate heavy analytical queries. Note that authentication alone is not a reliable control if attackers can obtain any valid low-privilege database account, since the flaw does not appear to require elevated rights once a session exists.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-121, stack-based buffer overflow, which is consistent with the reference tags flagging 'Buffer Overflow', 'Stack Overflow', 'Denial Of Service' and 'Db2'. Rather than a classic remote code execution primitive, the practical outcome here is memory corruption in the Db2 LUW engine during parsing or execution of a crafted query, terminating the database process and rendering the instance unavailable to connected clients. CPE data confirms the affected platform matrix as ibm:db2 on linux, unix and windows, and IBM's advisory scope explicitly includes Db2 Connect Server, meaning both direct database deployments and gateway/connectivity tiers are in scope. The published CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) implies an unauthenticated network attacker, but our assessment downgrades the privilege requirement to PR:L because query submission to a Db2 server normally requires an established, authenticated connection; the discrepancy is material to exposure modeling but does not change the availability-only impact profile. There is no confidentiality or integrity component, and the attack requires no user interaction.
Know when Db2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Submitting a query requires an authenticated Db2 session, so PR:L rather than PR:N; network-reachable with low complexity, availability-only crash so C:N/I:N/A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.
Executive ViewAI
IBM Db2 for Linux, UNIX, and Windows, including Db2 Connect Server, is affected by a high-severity vulnerability that allows an attacker to crash the database using a specially crafted SQL query, resulting in a denial of service. No vendor-released patch is identified at time of analysis, and no public exploit has been identified at time of analysis, with a low EPSS score of 0.1% indicating a low likelihood of exploitation. However, because Db2 often supports mission-critical applications, any downtime could disrupt business operations, so leadership should ensure interim mitigations are in place and monitor for vendor patches.
Restrict network access to the Db2 listener to trusted hosts, enforce strong authentication and least privilege, deploy database activity monitoring to detect malicious SQL patterns, and maintain offline backups. Monitor IBM advisories for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)NVD
Stack-based buffer overflow in the SQL/PSM (aka SQL Persistent Stored Module) Stored Procedure (SP) infrastructure in IB
IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a stack-bas
Stack-based buffer overflow in IBM DB2 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on Linux
IBM DB2 9.5 uses world-writable permissions for nodes.reg, which has unspecified impact and attack vectors. Rated critic
Remote code execution in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 lets unauthenticated network attackers run arbitrary co
Privilege escalation in IBM Db2 (data server versions 11.5.0-11.5.9 and 12.1.0-12.1.5) allows an attacker to submit a sp
Memory-corruption in IBM Db2's IXF file IMPORT parser lets an attacker supply a crafted IXF data file that overflows a s
Stack-based buffer overflow in the Java Stored Procedure infrastructure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7
Directory traversal vulnerability in the UTL_FILE module in IBM DB2 and DB2 Connect 10.1 before FP1 on Windows allows re
IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system
Integer signedness error in the db2dasrrm process in the DB2 Administration Server (DAS) in IBM DB2 9.1 through FP11, 9.
The Stored Procedure infrastructure in IBM DB2 9.5, 9.7 before FP9a, 10.1 before FP3a, and 10.5 before FP3a on Windows a
GitHub PoC
Exploit-DB