IBM Db2 HPU CVE-2025-33126

Exploitation requires an authenticated user (CVSS PR:L) with access to IBM Db2 High Performance Unload who can supply input processed by the vulnerable buffer-size calculation routine; it affects HPU versions 5.1, 5.1.0.1, 6.1, 6.1.0.1, 6.1.0.2, 6.1.0.3, 6.5, and 6.5.0.0 IF1. Limiting factors that reduce real-world risk: valid credentials/authentication are mandatory (no anonymous exploitation), the impact is confined to a crash with no confidentiality or integrity effect, and the product is a specialized Db2 add-on rather than a default-exposed internet service.

This is a moderate-severity denial-of-service issue (CVSS 6.5) in IBM Db2 High Performance Unload, stemming from CWE-131 (incorrect buffer size calculation). The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates a network-reachable, low-complexity attack requiring low-level authenticated privileges, with impact limited purely to availability (C:N/I:N) - no data disclosure or code execution is claimed. All exploitation signals point to low urgency: EPSS is 0.31% (21st percentile), there is no CISA KEV listing, and no public exploit code was identified. The signals are consistent rather than conflicting: a low EPSS aligns with the absence of KEV and POC, and the availability-only impact caps the real-world severity. This is a real but low-priority issue - patch in normal cycles rather than as an emergency. Because exploitation requires an already-authenticated user, the practical risk is largely insider or post-compromise, not opportunistic internet-wide attack.

An authenticated user with access to the Db2 High Performance Unload service sends specially crafted input that triggers an incorrect buffer-size calculation, causing the program to crash and interrupting unload/load operations. No public exploit code is known, and the attacker gains no code execution or data access - only a service outage. The impact is confined to availability of the HPU utility.