EUVD-2026-71488
GHSA-v392-pm9q-f3mc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted packet to Db2 Mirror for i service
-
ExploitTrigger out-of-bounds read in input parser
-
ExecutionCrash mirroring process
-
ImpactDisrupt HA replication link
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required - the CVSS vector AV:N/AC:L/PR:N/UI:N indicates remote unauthenticated exploitation against default configurations of IBM Db2 Mirror for i 7.4, 7.5, and 7.6. The primary limiting factor is network reachability: environments that isolate the Db2 Mirror for i replication service to a dedicated private VLAN or restrict it behind a firewall have substantially reduced attack surface. Impact is availability-only (A:L) with no confidentiality or integrity consequences per IBM's assessment. Only the three specified release streams are confirmed affected. |
| Impact | The CVSS 5.3 Medium rating is grounded in a fully unauthenticated, low-complexity network attack path (AV:N/AC:L/PR:N/UI:N) with limited availability impact (A:L) and no confidentiality or integrity exposure. Because no special preconditions are required, even a mid-sized IT operation in bytom running IBM i infrastructure should apply the available patch promptly to avoid a disruptive replication outage. However, the limited blast radius (A:L only - not A:H) indicates the service may partially recover or fail gracefully rather than producing a persistent crash. No EPSS score is provided; the CVE is not listed in the CISA KEV catalog, suggesting no observed active in-the-wild exploitation. The two mislabeled tags ('Buffer Overflow' and 'Information Disclosure') in the input conflict with the CWE-125 classification and C:N CVSS metric respectively - these should not inflate perceived risk beyond what the vector and description support. |
| Exploit ScenarioDerived | An attacker with network access to the IBM Db2 Mirror for i service sends a specially crafted packet that triggers an out-of-bounds read in the service's input-handling routine, causing the mirroring process to crash. The resulting service disruption breaks the HA replication link between production and mirror, leaving the environment without failover protection until the service is manually restarted and replication re-synchronized. No public proof-of-concept exploit has been identified at time of analysis, but the low-complexity, no-authentication attack path makes exploitation straightforward once the service is network-reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 04, 2026
Out-of-bounds read in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables a remote unauthenticated attacker to cause a denial of service by sending a crafted network request to the mirroring service. The flaw (CWE-125) is exploitable with no authentication or user interaction and can disrupt high-availability replication continuity. IBM has released a patch via advisory node/7285904; no public exploit code has been identified at time of analysis.
RemediationAI
IBM has released a patch addressing this vulnerability; administrators should consult the IBM advisory at https://www.ibm.com/support/pages/node/7285904 to obtain the specific PTF (Program Temporary Fix) identifiers for affected versions 7.4, 7.5, and 7.6 and apply them through the IBM i fix management process. No exact patched version string is independently extractable from the provided data - the advisory should be treated as the authoritative source for PTF numbers. As a compensating control prior to patching, restrict network access to Db2 Mirror for i replication ports using firewall rules or IBM i network filtering to permit connections only from known trusted mirroring partners; note that overly broad restrictions could interfere with legitimate HA replication traffic if partner IP ranges are not correctly scoped.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM Db2 Mirror for i is an IBM i (AS/400) platform high-availability component that provides near-real-time database replication between a production and a mirror system. CWE-125 (Out-of-Bounds Read) arises when a service reads beyond the allocated memory buffer - typically triggered by a malformed or oversized input packet that the parser does not bound-check correctly. While out-of-bounds reads can in some cases leak adjacent memory contents (information disclosure), IBM's own CVSS assessment specifies C:N, indicating no confirmed confidentiality impact; the primary consequence is process crash or service unavailability (A:L). The affected CPE is cpe:2.3:a:ibm:db2_mirror_for_i:*:*:*:*:*:*:*:*, covering the three release streams 7.4, 7.5, and 7.6.
Know when Db2 Mirror For I gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Unauthenticated network-accessible OOB read with no confidentiality or integrity impact, only partial availability disruption, aligns with IBM's own vector.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Db2 Mirror For I
View allOS command injection in IBM Db2 Mirror for i (releases 7.4, 7.5, and 7.6) lets a remote, unauthenticated attacker execut
Authenticated attackers with low privileges can escalate to elevated privileges on IBM i systems running Db2 Mirror for
Remote code execution in IBM Db2 Mirror for i (versions 7.4, 7.5, and 7.6) allows a remote unauthenticated attacker to r
Authentication bypass in IBM Db2 Mirror for i (versions 7.4, 7.5, and 7.6) lets a remote, unauthenticated attacker read
Remote CL command execution in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 lets a remote attacker run arbitrary Control Langu
Security restriction bypass in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 permits remote authenticated attackers to exceed t
Arbitrary file write via path traversal in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 enables remote unauthenticated attacke
Arbitrary file deletion in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 is achievable by remote authenticated attacke
Sensitive file disclosure in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 is possible through a path traversal flaw (
Path traversal in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote authenticated attackers to read sensiti
Arbitrary file write via path traversal in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes systems to unauthenti
Uncontrolled recursion in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote unauthenticated attackers to cr
Exploit-DB