EUVD-2026-57600
GHSA-g6q7-fjqm-mw94
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
IMPORT of an IXF file realistically requires an authenticated session with import rights, so PR:L rather than PR:N; network-reachable engine and no user interaction keep AV:N/AC:L/UI:N, with total C/I/A impact.
Primary rating from Vendor (ibm).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer overflow in the IXF IMPORT parser.
AnalysisAI
Memory-corruption in IBM Db2's IXF file IMPORT parser lets an attacker supply a crafted IXF data file that overflows a stack buffer (CWE-121), affecting Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on all listed platforms. Successful exploitation can crash the database engine or lead to code execution in the Db2 server process, yielding total loss of confidentiality, integrity, and availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the crafted input to reach Db2's IXF IMPORT parser - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals here conflict and warrant a nuanced priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can get a malicious IXF file processed - for example a user with IMPORT rights, or an automated pipeline that ingests IXF files from a semi-trusted source - crafts a file with an oversized length field in the IXF metadata. When Db2's IMPORT utility parses it, the stack buffer overflows, crashing the engine or executing attacker-controlled code in the privileged Db2 server process; no public proof-of-concept has been identified at time of analysis. |
| Remediation | Apply the IBM-provided fix referenced in the vendor advisory at https://www.ibm.com/support/pages/node/7279461 (Patch available per vendor advisory) - install the fixing fix pack / special build for your branch (upgrade beyond the affected 11.5.0-11.5.9 and 12.1.0-12.1.5 ranges; consult the IBM node page for the exact remediated build for your edition, as the precise fixed version is not restated in the raw data provided here). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all Db2 systems running versions 11.5.0-11.5.9 or 12.1.0-12.1.5, and disable IXF import functionality in any instance where this feature is not operationally critical. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Stack-based buffer overflow in the SQL/PSM (aka SQL Persistent Stored Module) Stored Procedure (SP) infrastructure in IB
IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a stack-bas
Stack-based buffer overflow in IBM DB2 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on Linux
IBM DB2 9.5 uses world-writable permissions for nodes.reg, which has unspecified impact and attack vectors. Rated critic
Remote code execution in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 lets unauthenticated network attackers run arbitrary co
Privilege escalation in IBM Db2 (data server versions 11.5.0-11.5.9 and 12.1.0-12.1.5) allows an attacker to submit a sp
Stack-based buffer overflow in the Java Stored Procedure infrastructure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7
Directory traversal vulnerability in the UTL_FILE module in IBM DB2 and DB2 Connect 10.1 before FP1 on Windows allows re
IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system
Integer signedness error in the db2dasrrm process in the DB2 Administration Server (DAS) in IBM DB2 9.1 through FP11, 9.
The Stored Procedure infrastructure in IBM DB2 9.5, 9.7 before FP9a, 10.1 before FP3a, and 10.5 before FP3a on Windows a
The scalar-function implementation in IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 o
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Stack Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today