IBM Db2 CVE-2025-13755

The attacker must possess an existing authenticated local OS account on the physical or virtual host running IBM Db2 - the CVSS attack vector AV:L confirms remote unauthenticated exploitation is not possible. PR:L in the CVSS vector confirms a standard low-privilege local account is sufficient; database administrator rights or OS root are not required. No special Db2 feature flag, non-default configuration, or specific deployment mode is described as a prerequisite in available data - the vulnerability is present across default installations of the affected version ranges on all three supported OS families (Linux, UNIX, Windows). Exploitation is inherently non-automatable per SSVC assessment because local host access cannot be achieved remotely at scale. The scope is unchanged (S:U), meaning this flaw alone does not grant access to other system components. Key limiting factors are: mandatory local OS shell access, no network-based attack path, no integrity or availability impact, and the absence of any public exploit code.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately captures a low-complexity, low-privilege local read scenario with high confidentiality impact - any authenticated local OS user on the host can potentially access sensitive log data without elevated rights or user interaction. However, all secondary intelligence signals consistently de-prioritize this issue: EPSS is 0.01% at the 2nd percentile, CISA SSVC marks exploitation as 'none' and automatable as 'no' (reflecting the mandatory local access prerequisite), and technical impact is 'partial' rather than total. There is no KEV listing and no public exploit code. The gap between a High CVSS confidentiality score and an extremely low EPSS is coherent here - log-based disclosure requires physical or logical local access, ruling out mass internet-scale exploitation. The real risk surface is insider threat, compromised service accounts, or post-exploitation lateral movement within an already-breached host. Organizations with strict OS-level separation between database service users and general users face meaningfully lower risk than those running Db2 on shared multi-tenant Linux systems.

A low-privileged local OS user on a Db2 database server - such as a developer with shell access, a compromised application service account, or a malicious insider - navigates to the Db2 diagnostic log directory and reads operational log files without needing database administrator credentials or root OS privileges. By parsing log content, the attacker extracts sensitive artifacts such as database user credentials, SQL statement text containing business-sensitive data, or internal configuration parameters, which can then be used to escalate database privileges or move laterally within the enterprise. No public exploit code exists, so this scenario relies on manual log inspection rather than automated attack tooling.