What is the CVSS score of CVE-2025-36407?

CVE-2025-36407 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Db2 are affected by CVE-2025-36407?

CVE-2025-36407 presents notable security risk rated CVSS 6.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-36407?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Db2 CVE-2025-36407

MEDIUM

Improper Validation of Specified Quantity in Input (CWE-1284)

2026-01-30 psirt@us.ibm.com

IBM Denial Of Service Db2

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

Patch released

Feb 09, 2026 - 15:16 nvd

Patch available

CVE Published

Jan 30, 2026 - 22:15 nvd

MEDIUM 6.5

DescriptionCVE.org

IBM® Db2® is vulnerable to a denial of service with a specially crafted query that uses ALTER TABLE operations.

AnalysisAI

IBM® Db2® is vulnerable to a denial of service with a specially crafted query that uses ALTER TABLE operations. [CVSS 6.5 MEDIUM]

Technical ContextAI

Affects Db2. IBM® Db2® is vulnerable to a denial of service with a specially crafted query that uses ALTER TABLE operations.

RemediationAI

A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.

More in Db2

View all

CVE-2012-4826 HIGH Act Now

8.5 Oct 20

Stack-based buffer overflow in the SQL/PSM (aka SQL Persistent Stored Module) Stored Procedure (SP) infrastructure in IB

CVE-2017-1297 HIGH This Week POC

7.3 Jun 27

IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a stack-bas

CVE-2014-3094 HIGH Act Now

8.5 Sep 04

Stack-based buffer overflow in IBM DB2 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on Linux

CVE-2012-1797 CRITICAL Act Now

10.0 Mar 20

IBM DB2 9.5 uses world-writable permissions for nodes.reg, which has unspecified impact and attack vectors. Rated critic

CVE-2026-10109 CRITICAL Act Now

9.8 Jun 30

Remote code execution in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 lets unauthenticated network attackers run arbitrary co

CVE-2026-10543 CRITICAL Act Now

9.8 Aug 12

Privilege escalation in IBM Db2 (data server versions 11.5.0-11.5.9 and 12.1.0-12.1.5) allows an attacker to submit a sp

CVE-2026-10534 CRITICAL Act Now

9.8 Aug 12

Memory-corruption in IBM Db2's IXF file IMPORT parser lets an attacker supply a crafted IXF data file that overflows a s

CVE-2012-2197 HIGH Act Now

7.1 Jul 25

Stack-based buffer overflow in the Java Stored Procedure infrastructure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7

CVE-2012-3324 CRITICAL Act Now

9.0 Sep 25

Directory traversal vulnerability in the UTL_FILE module in IBM DB2 and DB2 Connect 10.1 before FP1 on Windows allows re

CVE-2018-1426 CRITICAL Act Now

9.1 Mar 22

IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system

CVE-2012-0711 HIGH This Week

7.5 Mar 20

Integer signedness error in the db2dasrrm process in the DB2 Administration Server (DAS) in IBM DB2 9.1 through FP11, 9.

CVE-2013-6744 HIGH This Week

8.5 May 30

The Stored Procedure infrastructure in IBM DB2 9.5, 9.7 before FP9a, 10.1 before FP3a, and 10.5 before FP3a on Windows a

Same weakness CWE-1284 – Improper Validation of Specified Quantity in Input

View all

CVE-2025-9316 MEDIUM POC

6.9

CVE-2026-49777 CRITICAL POC

10.0

CVE-2022-37134 CRITICAL POC

9.8

CVE-2021-43267 CRITICAL POC

9.8

CVE-2025-65548 CRITICAL POC

9.1

CVE-2023-54337 CRITICAL POC

9.1

CVE-2025-5349 HIGH POC

8.8

CVE-2026-55706 HIGH POC

8.3

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

CVE-2025-36407 vulnerability details – vuln.today

Back

Db2 CVE-2025-36407

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Db2

Same weakness CWE-1284 – Improper Validation of Specified Quantity in Input

Same technique Denial Of Service

Share

External POC / Exploit Code