IBM DB2 HPU CVE-2025-33132

Exploitation requires an authenticated user (PR:L) with access to IBM DB2 High Performance Unload who can drive an unload/load operation or input that triggers CWE-467 (sizeof() used on a pointer type), causing an incorrect data-size calculation and a crash. Limiting factors: valid authentication to the HPU utility is mandatory, the impact is confined to availability (process crash) with no confidentiality or integrity effect and no code execution, and only the specific affected builds (6.1.0.3, 6.1.0.2, 6.1.0.1, 6.1, 6.5, 6.5.0.0 IF1, 5.1.0.1, 5.1) are at risk. Real-world reachability also depends on whether the utility is exposed beyond trusted administrators.

This is a moderate, availability-only issue that does not rise to an urgent-patch priority despite its 6.5 (MEDIUM) CVSS score. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) shows the only impact is availability (A:H) - the program crashes - with no confidentiality or integrity loss, and it requires at least low-level authentication (PR:L). The EPSS score of 0.31% (21st percentile) indicates a low probability of exploitation in the next 30 days, which is consistent with the absence of any CISA KEV listing and no identified public exploit code. No SSVC decision data was provided in the input. The underlying weakness is CWE-467 (Use of sizeof() on a Pointer Type), which corroborates a crash-style denial of service rather than memory-corruption leading to code execution. Signals are internally consistent here: a medium-severity, authenticated, DoS-only flaw with low exploitation probability and no evidence of real-world abuse. One note of caution: the CVSS declares AV:N (network) while the product is a data-unload utility typically run by DB2 administrators, so whether exploitation is truly remote/network-reachable depends on deployment - verify the actual exposure of the HPU service in your environment.

An authenticated user with access to IBM DB2 High Performance Unload submits crafted input or an unload operation that triggers an incorrect data-size calculation (sizeof on a pointer type), causing the program to crash and interrupting the unload/load service. No public exploit code or active exploitation has been identified, and the impact is limited to a denial of service with no data exposure or code execution.