IBM Db2 CVE-2025-36122

Authentication is mandatory-the attacker must possess valid Db2 user credentials with database connection privileges. The vulnerability does not require elevated administrative rights; any authenticated user account (read-only, application service account, analyst) can trigger the denial of service. The specially crafted SQL query must be submitted via a standard SQL interface (JDBC, ODBC, CLI, or native Db2 tools). Default configurations of vulnerable Db2 versions are susceptible; no specific non-default settings are required to enable the vulnerability. The attack is constrained to Db2 versions 11.5.0-11.5.9 and 12.1.0-12.1.3; versions outside this range (11.1, 11.4, 12.2+) are not affected. The impact is availability only-no data exfiltration, modification, or privilege escalation is possible.

CVSS 6.5 with network attack vector and low complexity reflects a moderate but realistic risk: authenticated access is required (PR:L), but the attack surface includes any user with valid database credentials, including application service accounts, read-only analysts, or compromised low-privilege accounts. EPSS data is not provided, but the availability impact (A:H) combined with network-accessible database services makes this operationally disruptive in production environments. The vulnerability does not leak data or enable privilege escalation, which limits strategic impact compared to confidentiality or integrity breaches. However, the lack of a KEV listing and absence of public exploit code suggest this is a lower-priority target for attackers currently focused on remote code execution or authentication bypass vulnerabilities. Real-world risk depends heavily on deployment: internet-facing Db2 instances with broad user provisioning face elevated risk; air-gapped or tightly access-controlled databases face lower risk. Organizations should prioritize this based on threat modeling rather than raw CVSS alone-a denial-of-service vulnerability is critical if the database supports life-critical services (healthcare, financial) but lower priority if used only for batch analytics.

A database administrator's credentials are compromised via phishing. An attacker uses the stolen credentials to connect to a production Db2 instance over the network and submits a specially crafted SQL SELECT query (e.g., a pathological join or subquery) that causes the query optimizer to allocate excessive memory or CPU cycles. Within seconds, the Db2 process becomes unresponsive, and the database becomes unavailable to the application tier, triggering cascading service failures and user-facing outages.