IBM Db2 CVE-2026-18096

Exploitation requires local, authenticated access to the system hosting IBM Db2 12.1.5, with at minimum low-privilege OS-level credentials (CVSS AV:L, PR:L). The attacker must be able to interact with Db2 processes from a local session to repeatedly trigger the memory-leaking condition. Limiting factors include: unauthenticated remote exploitation is ruled out by the local attack vector; the impact ceiling is low-severity availability degradation (A:L), not database compromise or data exfiltration; and confidentiality and integrity are entirely unaffected. Environments using DB2 Connect Server as a gateway are within scope if local access to the Connect Server host is obtained, slightly broadening the affected deployment surface beyond standalone Db2 instances.

The CVSS 3.1 base score of 3.3 (Low) accurately reflects a tightly constrained risk profile: the attack vector is local (AV:L), requiring the attacker to already hold a foothold on the Db2 host, and low privileges (PR:L) mean an OS-level authenticated session is prerequisite. The impact is restricted entirely to availability at the lowest severity tier (A:L), indicating degradation rather than outright crash, with zero confidentiality or integrity exposure. No EPSS score was included in the available intelligence, no CISA KEV listing exists, and no public PoC code has been identified, collectively suggesting this vulnerability sees little to no opportunistic exploitation activity. The SSVC automatable dimension would rate low given local access requirements, and technical impact is partial at best. A mid-sized enterprise database team in gdynia running IBM Db2 can safely schedule this patch within a standard monthly maintenance window rather than treating it as emergency response. The primary residual risk is post-compromise persistence abuse - an attacker who already has local access using this to destabilize database availability as a secondary effect - not direct internet-facing exploitation.

A local user with a standard OS account on an IBM Db2 12.1.5 host repeatedly invokes the vulnerable code path, triggering the memory leak in the Db2 process. Over an extended period, the accumulated unfreed memory exhausts available system memory, degrading database responsiveness and potentially causing the Db2 instance to become unresponsive. No public PoC has been identified at time of analysis, making this scenario most relevant in insider threat or post-compromise contexts.