What is the CVSS score of CVE-2026-18096?

CVE-2026-18096 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-18096?

Yes, a patch is available for CVE-2026-18096. Update the affected software to the latest version immediately.

IBM Db2 CVE-2026-18096

EUVD-2026-57618 LOW

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-08-12 ibm

GHSA-m3x8-g2xx-c49m

Denial Of Service IBM Microsoft Db2

3.3

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

3.3 LOW

Local access with low-privilege OS credentials required; sole impact is low-severity availability degradation from uncontrolled memory leak with no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 21:41 vuln.today

CVE Published

Aug 12, 2026 - 20:47 nvd

LOW 3.3

DescriptionCVE.org

IBM Db2 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to cause a denial of service due to a memory leak.

AnalysisAI

Memory leak denial of service in IBM Db2 12.1.5 for Linux, UNIX, and Windows (including DB2 Connect Server) enables a local attacker with low-privilege credentials to exhaust system resources and degrade database availability. Rooted in CWE-770 (uncontrolled resource allocation), the flaw requires no user interaction beyond an authenticated local session. No public exploit code or active exploitation is identified; IBM has released a patch via its support portal.

Technical ContextAI

IBM Db2 is a widely deployed enterprise relational database management system supporting Linux, UNIX, and Windows platforms, with the DB2 Connect Server component enabling distributed database connectivity. CWE-770 (Allocation of Resources Without Limits or Throttling) identifies the root cause as a failure to bound or release memory allocations within Db2 process execution, resulting in a progressive memory leak that a local user can trigger to consume system resources. The affected CPE cpe:2.3:a:ibm:db2:*:*:*:*:*:*:*:* with the wildcard version field indicates the NVD entry is broadly scoped across Db2 product variants, though the CVE description precisely identifies version 12.1.5 as the confirmed affected release. The DB2 Connect Server inclusion is notable as it extends the affected surface to Db2 gateway deployments in addition to standalone database servers.

RemediationAI

Apply the vendor-released patch documented in IBM's support advisory at https://www.ibm.com/support/pages/node/7282953. IBM has confirmed patch availability, though the specific replacement fix pack or version string is not independently enumerated in the available reference data beyond the advisory link, so administrators should consult the advisory directly for the exact target version. As a compensating control while scheduling the patch, restrict local OS-level access to accounts that require Db2 interaction, and audit which non-DBA accounts hold local login rights on Db2 host systems - this directly limits the PR:L prerequisite and reduces exposure. Restricting local account access may affect legitimate administrative and application service accounts, so coordinate changes with DBA and application teams before implementation. No workaround fully remediates the memory leak itself; patching remains the definitive resolution.