IBM Db2 CVE-2026-104332

Exploitation requires (1) a valid authenticated Db2 connection with a low-privileged account (PR:L) and (2) the ability to execute a query that references or operates on a Materialized Query Table (MQT) - the MQT code path is the specific feature that triggers the stack-based buffer overflow. Affected builds are Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5. Limiting factors that reduce real-world risk: no anonymous/unauthenticated path (credentials or a trusted application account are needed), impact is confined to denial of service (no data disclosure or modification), and the vendor-assigned AV:L implies local reachability - though the query-execution nature suggests any authenticated network client submitting the crafted MQT query may suffice, which should be confirmed with IBM.

This is a moderate-severity, availability-only issue that should be treated as a patch-management item rather than an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) describes a locally-reachable, low-complexity flaw that requires an authenticated low-privileged account (PR:L) and yields only a denial-of-service (A:H) with no confidentiality or integrity impact. No EPSS score, CISA KEV listing, SSVC decision data, or public proof-of-concept was provided, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. Note a signal conflict worth verifying with the vendor: the vector asserts AV:L (local), yet the description describes triggering the fault by 'executing a specially crafted query,' which in Db2 is normally done by a database user over a client/network session - this suggests the practical attack surface may be network-reachable to any authenticated DB user rather than strictly local. CWE-121 (stack-based buffer overflow) raises the theoretical possibility of memory corruption, but IBM scored impact as A:H only (no C/I), so the realistic outcome is a crash/DoS of the Db2 instance, not code execution - do not escalate this to RCE absent vendor confirmation. Bottom line: a genuine but bounded operational-availability risk requiring existing authenticated access, best scheduled into normal patch cycles unless the Db2 instance is multi-tenant or exposed to low-trust query users.

An authenticated low-privileged Db2 user (or a compromised application account with query access) submits a specially crafted query involving a Materialized Query Table, triggering a stack-based buffer overflow that crashes the database engine and denies service to all connected applications. No public exploit code is known, and because only availability is affected, the impact is an outage rather than data theft or code execution. Exploitation requires a valid database connection, limiting it to insiders or attackers who have already obtained credentials.