What is the CVSS score of CVE-2026-10535?

CVE-2026-10535 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of IBM Db2 are affected by CVE-2026-10535?

IBM Db2 versions 11.5.x and 12.1.x contain a local privilege escalation vulnerability enabling any local user to gain elevated group-level permissions, creating insider threat and data access risks…. A patch is available.

How to fix or mitigate CVE-2026-10535?

Within 24 hours, identify and inventory all systems running IBM Db2 11.5.x (through 11.5.9) or 12.1.x (through 12.1.4), prioritizing instances with multiple local users or multi-tenant access patterns. Within 7 days, apply the available vendor patch to all affected instances in staging and non-production environments to validate compatibility and operational impact. Within 30 days, complete patching of all production instances using scheduled maintenance windows, and verify that Db2 services are restarted post-patch to activate kernel-level mitigations.

IBM Db2 CVE-2026-10535

EUVD-2026-51250 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-30 ibm

GHSA-355r-5322-3222

Buffer Overflow IBM Stack Overflow Db2

7.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local setgid binary requires shell access (AV:L, PR:L); stack overflow is straightforward to trigger with no interaction (AC:L, UI:N); db2 group compromise yields full instance-level C/I/A impact with no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 05, 2026 - 20:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 05, 2026 - 20:37 vuln.today

cvss_changed

CVSS changed

Aug 05, 2026 - 20:37 NVD

8.4 (HIGH) 7.8 (HIGH)

Analysis Generated

Jul 30, 2026 - 17:54 vuln.today

CVE Published

Jul 30, 2026 - 16:55 cve.org

HIGH 8.4

DescriptionNVD

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc.

AnalysisAI

Stack-based buffer overflow in IBM Db2's setgid helper binary db2flacc allows a local user with low privileges to overwrite the stack frame and execute arbitrary code with the elevated group permissions of the binary. Both Db2 11.5.x (through 11.5.9) and 12.1.x (through 12.1.4) are affected. No public exploit has been identified and exploitation status is confirmed as none per SSVC, though IBM has released a patch and the SSVC technical impact is rated total, warranting prompt remediation on shared-access Db2 hosts.

Technical ContextAI

The vulnerability resides in db2flacc, a setgid helper utility shipped with IBM Db2 that runs with elevated group-level privileges to perform file access control operations on behalf of the database engine. CWE-121 (Stack-based Buffer Overflow) identifies the root cause as improper bounds checking before copying attacker-controlled data into a fixed-size stack buffer, enabling overwrite of the saved return address or adjacent stack data. Setgid binaries are a classic local privilege escalation vector: successful exploitation causes execution to resume under the effective group identity of db2flacc (typically the db2 administrative group), granting unauthorized access to database files, instance directories, and related administrative operations without requiring any database credentials. Affected CPE is cpe:2.3:a:ibm:db2:*:*:*:*:*:*:*:*, spanning the 11.5 and 12.1 release trains.

RemediationAI

IBM has released a patch for this vulnerability; administrators should consult the IBM support advisory at https://www.ibm.com/support/pages/node/7279466 to identify the exact target fixpack or interim fix applicable to their installed version of Db2 11.5.x or 12.1.x - the specific patched build version is not enumerated in the available intelligence and must be confirmed directly from the advisory. While awaiting patching, compensating controls include restricting local shell access to Db2 hosts exclusively to authorized database administrators, thereby eliminating the PR:L foothold required for exploitation; note that removing general user shell access may impact application-tier workflows that rely on local OS connectivity. Restricting or removing setgid permissions on db2flacc itself is theoretically possible but may break Db2 file access control operations and should be validated thoroughly in a non-production environment before deployment. Auditing which OS accounts hold local login rights on Db2 servers reduces the realistic attacker population in the interim.