IBM Db2 CVE-2026-10534

Exploitation requires the crafted input to reach Db2's IXF IMPORT parser - i.e. an IMPORT (or related file-load) operation must process an attacker-supplied IXF file, meaning the attacker needs either the privilege to run IMPORT against the database or a path that feeds untrusted IXF files into an existing import workflow. Only Db2 11.5.0-11.5.9 and 12.1.0-12.1.5 are affected. Limiting factors: although the vendor CVSS is AV:N/AC:L/PR:N/UI:N, the IMPORT utility in practice presumes an authenticated database session and IMPORT authorization, so real-world exploitation is gated by who can invoke IMPORT and supply the file; SSVC rates exploitation as 'none' and not automatable, and no user interaction beyond triggering the import is needed. The PR:N claim should be validated against your instance's IMPORT authorization configuration.

The signals here conflict and warrant a nuanced priority. The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) with 'total' SSVC technical impact frames this as a critical, unauthenticated, remotely triggerable flaw - but that rating sits in tension with how the vulnerable code path is actually reached: IMPORT of an IXF file is a database utility that normally requires an authenticated session and the privilege/ability to run IMPORT and reference a data file, which realistically implies at least low privileges rather than PR:N. Weighing that against the exploitation-side evidence, SSVC marks Exploitation as 'none' and Automatable as 'no', and EPSS is only 0.18% (7th percentile), so there is no sign of active exploitation or easy mass-automation; the practical risk is a privileged/authenticated attacker (or a workflow that ingests untrusted IXF files) achieving crash-to-code-execution against the DB server. In short, treat it as a real must-patch for any Db2 instance that imports files from semi-trusted sources or exposes IMPORT to lower-trust users, but the low EPSS and 'none' exploitation status mean it is not an emergency drop-everything internet-worm scenario - verify the PR:N assumption against your own IMPORT authorization model before ranking it above confirmed in-the-wild bugs.

An attacker who can get a malicious IXF file processed - for example a user with IMPORT rights, or an automated pipeline that ingests IXF files from a semi-trusted source - crafts a file with an oversized length field in the IXF metadata. When Db2's IMPORT utility parses it, the stack buffer overflows, crashing the engine or executing attacker-controlled code in the privileged Db2 server process; no public proof-of-concept has been identified at time of analysis.