IBM DB2 HPU
CVE-2025-33133
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Db2 HPU utility
-
ExploitSubmit crafted unload/load input
-
ExecutionTrigger out-of-bounds write
-
ImpactCrash process (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated user (PR:L) with access to IBM Db2 High Performance Unload; exploitation is network-reachable (AV:N) with low complexity (AC:L) and no user interaction, but the attacker must supply crafted input to the unload/load processing to trigger the out-of-bounds write. Limiting factors: valid credentials are mandatory, and realistic impact is confined to crashing the utility (A:H) - there is no confirmed confidentiality or integrity impact and no evidence of code execution. Affected builds are specific HPU versions (5.1, 5.1.0.1, 6.1 through 6.1.0.3, 6.5, 6.5.0.0, 6.5.0.0 IF1). |
| Impact | This is a genuine but low-urgency issue. The vendor-provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5 MEDIUM) describes a network-reachable but authenticated denial-of-service: an out-of-bounds write (CWE-787) that crashes the program with no confidentiality or integrity impact (C:N/I:N, A:H only). EPSS is low at 0.31% (21st percentile), consistent with a DoS-only, authenticated flaw that is unattractive to mass exploitation. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed actively exploited. Note the tension between signals: the tags 'Buffer Overflow'/'Memory Corruption' and the CWE-787 OOB-write primitive often suggest code-execution potential, but IBM's own impact scoring caps it at availability (crash) only - treat RCE as unproven and the realistic worst case as a service crash. This is a routine-patch item (prioritize behind anything with code-exec or unauthenticated impact), not an emergency. |
| Exploit ScenarioDerived | An attacker who already holds valid credentials to a system running IBM Db2 High Performance Unload submits crafted input that triggers an out-of-bounds write, crashing the unload/load utility and disrupting the data-movement operation. The attack is network-reachable with low complexity but requires authentication (PR:L); no public exploit code is currently available, and the impact is limited to a crash rather than code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
IBM Db2 High Performance Unload (HPU) versions 5.1 through 6.5.0.0 IF1 contain an out-of-bounds write (CWE-787) that an authenticated user can trigger with crafted input, causing the utility to crash and resulting in a denial-of-service condition. The vulnerability requires valid credentials (PR:L) and is network-reachable (AV:N) with low complexity (AC:L) and no user interaction, but the assessed impact is limited to availability (A:H) with no confirmed confidentiality or integrity impact and no evidence of code execution. EPSS is low at 0.31% (21st percentile), and no public exploit code or active exploitation (CISA KEV) has been identified.
RemediationAI
Patch availability is not specified in the provided data; consult the IBM advisory at https://www.ibm.com/support/pages/node/7249336 for the exact fixed version and upgrade instructions. Until a patch is applied, restrict access to IBM Db2 High Performance Unload to trusted authenticated users only, and enforce least-privilege database accounts that can invoke the utility, since exploitation requires valid credentials (PR:L). Monitor for abnormal termination or crashes of the HPU utility, which may indicate attempted exploitation. Network-level controls such as firewall rules limiting which hosts can reach the HPU service can reduce exposure but may not be feasible if remote management is required. Running HPU with minimal OS privileges can help contain the impact of a crash. No public exploit code or active exploitation has been identified, so the immediate priority is to apply vendor updates as they become available and maintain strict access controls.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM Db2 High Performance Unload (HPU) is a utility used for high-speed unloading and loading of Db2 data. The vulnerability is an out-of-bounds write (CWE-787), which occurs when the software writes data past the end of an allocated buffer due to insufficient bounds checking on input. An authenticated attacker who can supply crafted input to the unload/load processing can trigger a memory corruption condition that crashes the utility. While out-of-bounds writes can sometimes lead to code execution, the independent assessment confirms that the realistic impact is confined to availability (crash), with no evidence of code execution or data compromise. Affected CPE entries include cpe:2.3:a:ibm:db2_high_performance_unload_load across multiple version ranges and specific builds such as 6.1.0.1, 6.1.0.2, 6.1.0.3, 6.5.0.0, and 6.5.0.0:if1.
Know when Db2 High Performance Unload Load gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable utility exploitable by any authenticated user (PR:L, AC:L) with crafted input; impact is a crash only, so C:N/I:N/A:H.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to crash due an out of bounds write.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Affected Products (CPE)CVE.org
IBM DB2 High Performance Unload load for LUW 6.1 and 6.5 could allow a local attacker to execute arbitrary code on the s
IBM DB2 High Performance Unload load for LUW 6.1 and 6.5 is vulnerable to a buffer overflow, caused by improper bounds c
IBM DB2 High Performance Unload load for LUW 6.1, 6.1.0.1, 6.1.0.1 IF1, 6.1.0.2, 6.1.0.2 IF1, and 6.1.0.1 IF2 db2hpum an
IBM DB2 High Performance Unload load for LUW 6.1, 6.1.0.1, 6.1.0.1 IF1, 6.1.0.2, 6.1.0.2 IF1, and 6.1.0.1 IF2 db2hpum_de
IBM DB2 High Performance Unload (HPU) contains a denial-of-service vulnerability that allows an authenticated remote use
Authenticated users of IBM DB2 High Performance Unload (HPU) versions 5.1, 5.1.0.1, 6.1, 6.1.0.1, 6.1.0.2, 6.1.0.3, 6.5,
Denial of service in IBM Db2 High Performance Unload (HPU) 5.1, 5.1.0.1, 6.1, 6.1.0.1, 6.1.0.2, 6.1.0.3, 6.5, and 6.5.0.
GitHub PoC
Exploit-DB