IBM DB2 HPU
CVE-2025-33131
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to DB2 HPU (PR:L)
-
ExploitSubmit crafted unload/load input
-
ExecutionOverflow stack-allocated buffer
-
ImpactCrash HPU process (A:H denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated account on IBM DB2 High Performance Unload (PR:L) - the vulnerability is not reachable by anonymous external attackers. Affected versions are 5.1, 5.1.0.1, 6.1, 6.1.0.1, 6.1.0.2, 6.1.0.3, 6.5, and 6.5.0.0 IF1. The impact is limited to a process crash (denial of service); there is no data disclosure or modification path, and no user interaction is needed once authenticated. The specific utility operation or input that overwrites the stack buffer is not disclosed in the advisory, so the precise trigger condition is unconfirmed. |
| Impact | This is a moderate-priority, availability-only defect that does not warrant emergency remediation. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) scores 6.5 purely on an A:H crash impact - there is no confidentiality or integrity loss (C:N/I:N), and exploitation requires an already-authenticated user (PR:L). The stack buffer overwrite is described only as causing the program to crash, not as achieving code execution, so despite the CWE-120 'buffer overflow' classification this behaves as a denial-of-service rather than an RCE. Supporting signals confirm low real-world urgency: EPSS is 0.31% (21st percentile), there is no CISA KEV listing, and no public exploit code was identified. Exploitation status: no public exploit identified at time of analysis. The authentication requirement plus availability-only impact mean the realistic worst case is a trusted or compromised DB2 user disrupting unload/load jobs, not external compromise - a genuine but low-to-medium operational risk, not a high-real-risk issue despite the network attack vector. |
| Exploit ScenarioDerived | An authenticated user of IBM DB2 High Performance Unload supplies crafted input to a job or utility operation that overwrites a stack-allocated buffer, corrupting the stack and crashing the HPU process. This disrupts database unload/load operations (A:H) but does not expose or alter data. No public proof-of-concept exploit is known, and the attacker must already hold valid credentials (PR:L). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Authenticated users of IBM DB2 High Performance Unload (HPU) versions 5.1, 5.1.0.1, 6.1, 6.1.0.1, 6.1.0.2, 6.1.0.3, 6.5, and 6.5.0.0 IF1 can trigger a stack buffer overwrite that crashes the utility process, producing a denial-of-service condition with no confidentiality or integrity impact. The flaw requires a valid authenticated account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base score 6.5), is rated low risk by EPSS (0.31%, 21st percentile), and is not listed in CISA KEV; no public exploit code was identified at time of analysis, and the exact input or utility operation that overflows the stack allocation is not disclosed in the vendor advisory.
RemediationAI
Obtain the corrected HPU build through the IBM Support advisory at https://www.ibm.com/support/pages/node/7249336; the provided data does not include an exact fix version or PTF number, and this analysis found no vendor-released patch identified at time of analysis, so version confirmation must come from IBM rather than assumption. Because the issue is availability-only and requires a valid account (PR:L), the practical exposure is limited to users who already have legitimate HPU access: restrict HPU accounts and network reachability of the utility to trusted administrators only, and remove or disable unused credentials, accepting that this reduces flexibility for legitimate operators. Monitor HPU process terminations and enable service supervision or automatic restart so a crash degrades to a brief outage rather than an extended one - noting this treats the symptom and does not remove the buffer overwrite condition. Rate-limiting or segmenting connections to the HPU service from untrusted hosts is a further compensating control but cannot be targeted at the specific flawed operation, since the exact trigger input is unconfirmed. No public exploit code was identified, and the low EPSS score (0.31%, 21st percentile) combined with the absence of KEV listing supports scheduling this patch in a routine maintenance window rather than invoking emergency change procedures.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is a classic stack-based buffer overflow (CWE-120): data exceeds the bounds of a fixed-size buffer allocated on the stack, corrupting adjacent memory and terminating the process. IBM's CPE entries map the exposure to db2_high_performance_unload_load across the 5.1.x and 6.1.x branches and the 6.5.0.0 release including its IF1 fix pack (cpe:2.3:a:ibm:db2_high_performance_unload_load:6.5.0.0:if1:*:*:*:*:*:*), indicating the underlying parsing/allocation code is shared across these builds rather than introduced by a single update. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N with only the Availability metric affected, the vulnerable path is network-reachable but gated behind authentication, and exploitation yields a crash rather than code execution or data leakage; no write-what-where primitive or control-flow hijack has been demonstrated from the available data.
Know when Db2 High Performance Unload Load gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Authenticated user (PR:L) remotely triggers a stack overwrite that only crashes the program, yielding A:H with no confidentiality or integrity impact.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to crash due to a buffer being overwritten when it is allocated on the stack.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)NVD
IBM DB2 High Performance Unload load for LUW 6.1 and 6.5 could allow a local attacker to execute arbitrary code on the s
IBM DB2 High Performance Unload load for LUW 6.1 and 6.5 is vulnerable to a buffer overflow, caused by improper bounds c
IBM DB2 High Performance Unload load for LUW 6.1, 6.1.0.1, 6.1.0.1 IF1, 6.1.0.2, 6.1.0.2 IF1, and 6.1.0.1 IF2 db2hpum an
IBM DB2 High Performance Unload load for LUW 6.1, 6.1.0.1, 6.1.0.1 IF1, 6.1.0.2, 6.1.0.2 IF1, and 6.1.0.1 IF2 db2hpum_de
IBM Db2 High Performance Unload (HPU) versions 5.1 through 6.5.0.0 IF1 contain an out-of-bounds write (CWE-787) that an
IBM DB2 High Performance Unload (HPU) contains a denial-of-service vulnerability that allows an authenticated remote use
Denial of service in IBM Db2 High Performance Unload (HPU) 5.1, 5.1.0.1, 6.1, 6.1.0.1, 6.1.0.2, 6.1.0.3, 6.5, and 6.5.0.
GitHub PoC
Exploit-DB