IBM Db2 CVE-2025-14688

Exploitation requires: (1) valid authenticated access to the Db2 instance (username and password or application credentials); (2) Db2 configured with the specific feature or configuration setting that triggers the query parsing flaw - the description states 'when certain configurations exist' but does not specify which; (3) ability to submit SQL queries to the database (via direct client connection, application interface, or stored procedure); (4) high attack complexity (AC:H from CVSS) suggests the query payload requires precise formatting or timing to trigger the crash. Exploitation is NOT possible against default unconfigured Db2 instances or versions outside 11.5.0-11.5.9 and 12.1.0-12.1.3. The vulnerability does not grant code execution, privilege escalation, or data exfiltration - impact is strictly denial of service to the database process.

CVSS 5.3 with vector AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H indicates this is a moderate-severity, network-accessible denial-of-service requiring authenticated access and high attack complexity. The limiting factors - authentication requirement (PR:L), high complexity (AC:H), and configuration-specific trigger - significantly reduce real-world risk compared to a simple DoS. EPSS score not provided, but the combination of required authentication and high complexity suggests this is unlikely to be broadly exploitable in uncontrolled environments. Active exploitation status unknown (no KEV listing confirmed, no POC data provided). The 'certain configurations exist' language in the description is critical: defenders on non-vulnerable configurations may not be at risk, making inventory and configuration audit necessary. Risk is primarily to multi-tenant or shared Db2 instances where malicious insiders or compromised application accounts exist.

An insider with valid Db2 credentials, or an attacker who has compromised an application account connecting to Db2, submits a specially crafted SQL query containing unescaped special characters or syntax elements targeting the vulnerable query parser. The database engine fails to neutralize these elements during parsing, triggering an exception or infinite loop in the optimizer that consumes CPU or memory until the Db2 process crashes or becomes unresponsive, denying service to all legitimate users. Recovery requires manual restart of the database service.