Informix Dynamic Server CVE-2026-13361

Exploitation requires an authenticated SQL session with at least low-privilege credentials on the target IBM Informix Dynamic Server instance, consistent with the CVSS PR:L metric. The attacker must have network connectivity to the Informix SQL listener (CVSS AV:N, AC:L) - typically exposed on TCP port 9088 or a site-configured variant. The vulnerable code path is triggered during normal SQL query preparation via the sq_sgkprepare function in the oninit daemon when a request with an unchecked SQL interface length field is processed; no special non-default server configuration is described as required beyond an operational Informix SQL listener. Exploitation is limited by the credential requirement - unauthenticated exploitation is not supported by available CVSS or description data. Environments that restrict SQL listener access to specific trusted hosts or that enforce strong credential hygiene are meaningfully harder to exploit.

The CVSS 3.1 score of 8.8 reflects a network-reachable (AV:N), low-complexity (AC:L) attack requiring only low-privilege SQL credentials (PR:L) with no user interaction and full CIA impact - characteristics consistent with a highly dangerous RCE class vulnerability. The PR:L requirement meaningfully constrains the attacker pool compared to unauthenticated (PR:N) flaws; exploitation requires valid SQL credentials, which limits opportunistic mass exploitation. EPSS data was not provided in available intelligence, so quantitative exploitation probability cannot be stated. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept exploit has been identified at time of analysis. IBM Informix is a niche enterprise database compared to mainstream systems like Oracle or SQL Server, further concentrating real-world risk to organizations actively running Informix with network-exposed listeners. IBM has released a patch, making this a prioritized but not emergency patching scenario for most environments, absent active exploitation evidence.

An attacker with low-privilege SQL credentials connects to an IBM Informix Dynamic Server instance over the network and submits a crafted SQL request containing a malformed or oversized length field during the query preparation phase handled by sq_sgkprepare. The missing bounds check causes a stack-based buffer overflow in the oninit daemon, overwriting the stack return address and allowing the attacker to redirect execution to attacker-controlled code or a ROP chain, achieving remote code execution with the privileges of the Informix server process. No public proof-of-concept exploit has been identified at time of analysis.