IBM Db2 CVE-2026-105466

Exploitation requires an authenticated Db2 session with INSERT privileges on a table that defines one or more XML columns; the malicious INSERT must meet unspecified 'specific conditions' noted in the description but not quantified in the available data. Limiting factors: the attacker must already be authenticated (PR:L), the target table must use the XML data type, and the undisclosed trigger conditions may further narrow real-world exploitability. There is no user-interaction requirement (UI:N) and the vector is network-reachable (AV:N), but the privilege requirement rules out anonymous attackers. Affected deployments are Db2 11.5.0-11.5.9 and 12.1.0-12.1.5.

This is a moderate-priority availability issue, not a critical emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) indicates a network-reachable denial of service that an attacker can trigger with low attack complexity but which requires at least low-level privileges (PR:L) - i.e. an authenticated database account with permission to INSERT into a table containing XML columns. There is no confidentiality or integrity impact (C:N/I:N); the sole impact is availability (A:H), consistent with CWE-770 (uncontrolled resource consumption). No EPSS score, SSVC decision data, or POC indicator was supplied in the input, and the CVE is not listed in CISA KEV, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is therefore bounded: an insider or any account that already holds INSERT rights on an XML-column table could disrupt the database, but there is no path for an unauthenticated remote attacker. Note the description qualifier 'under specific conditions,' which is not quantified in the supplied data and may make real-world triggering harder than AC:L alone suggests - verify exact trigger conditions with the IBM advisory before assuming trivial exploitability.

An attacker holding a legitimate low-privilege Db2 account with INSERT rights issues a specially crafted INSERT into a table that contains XML columns, triggering uncontrolled resource consumption that crashes or hangs the database instance and denies service to all users. No public exploit code was identified in the provided data, and exploitation requires an authenticated session rather than anonymous network access.