EUVD-2026-32489
GHSA-gpjv-6r8h-vp58
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain query access to Db2 instance
-
ExploitCraft query targeting MDC tables
-
ExecutionTrigger uncontrolled memory consumption
-
ImpactExhaust memory causing denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target Db2 deployment must actually use MDC (multi-dimensional clustering) tables, and the attacker must be able to submit the specific triggering queries against them. Although the input CVSS vector lists PR:N, executing SQL queries against Db2 realistically requires a valid database connection/credentials, so a low-privileged authenticated user is the likely true precondition. Affected builds are Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4. Limiting factors: deployments without MDC tables are not exploitable, impact is confined to availability (no confidentiality or integrity loss), and the SSVC assessment marks exploitation as not automatable. |
| Impact | All signals converge on a moderate, low-urgency availability issue rather than a top priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores 7.5 purely on A:H with no confidentiality or integrity impact (CWE-400, uncontrolled resource consumption / out-of-memory). The EPSS score of 0.04% (12th percentile) is very low, and CISA SSVC classifies Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial' - all consistent with a non-automatable denial-of-service bug. There is no KEV listing and no public exploit identified, so this is a high-CVSS-but-low-real-risk issue for most environments. IMPORTANT CONFLICT: the CVSS vector claims PR:N (unauthenticated), yet the vulnerability requires 'executing certain queries with MDC tables', which in practice requires a valid Db2 session and the ability to issue SQL - implying at least a low-privileged authenticated user. This PR:N rating should be verified with IBM; if authentication is in fact required, real-world risk is further reduced. The SSVC 'partial' technical impact also undercuts the vector's A:H. |
| Exploit ScenarioDerived | A user able to submit SQL to an affected Db2 instance crafts specific queries against multi-dimensional clustering (MDC) tables that cause Db2 to consume excessive memory until it exhausts available memory, degrading or halting the database service (denial of service). No public exploit code has been identified, and the attack produces no data disclosure or modification - only availability loss. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 14, 2026
Memory exhaustion in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 lets a user who can submit crafted SQL against MDC (multi-dimensional clustering) tables drive the database engine out of memory, degrading or halting availability with no confidentiality or integrity impact. The flaw is only reachable where the deployment actually uses MDC tables and where the triggering queries can be submitted; note that while the published CVSS vector lists PR:N, the assessed vector is PR:L, reflecting that a valid database connection and credentials are realistically required. Exploitation is not automatable per CISA's SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial), EPSS is only 0.04% (12th percentile), and no public exploit code has been identified at time of analysis - every signal points to a moderate, low-urgency availability issue rather than a top priority.
Earlier versions of this analysis (1)
Memory exhaustion in IBM Db2 11.5.x and 12.1.x allows an authenticated remote attacker to crash the database engine by submitting certain queries targeting Multi-Dimensional Clustering (MDC) tables, resulting in a denial of service. The vulnerability carries a CVSS 6.5 score with network-accessible attack vector and low-privilege requirement, meaning any valid database user can trigger it. No active exploitation has been identified at time of analysis; SSVC rates exploitation status as none and technical impact as partial.
RemediationAI
Patch status: no vendor-released patch identified at time of analysis, and no exact fix version is specified in the provided data - treat IBM's advisory (https://www.ibm.com/support/pages/node/7273557) as the authoritative source for the maintenance release IBM names for the 11.5.x and 12.1.x lines and upgrade to that level. Until a fix is applied, use targeted compensating controls rather than generic hardening: cap the damage with Db2 memory limits and per-connection/agent memory thresholds (for example APPL_MEMORY_THRESHOLD) so a runaway statement is terminated instead of exhausting the host - the trade-off is that legitimate large analytic queries may also be killed, so tune the ceilings against normal workload; enable Db2 Workload Manager to police ad hoc SQL with concurrency and resource caps - the trade-off is throttling that applies to every query in the managed service class; restrict SELECT privileges on MDC tables to the smallest set of roles that genuinely need them, since the issue requires a user able to submit the triggering query - the trade-off is that broad BI/reporting access must be redesigned or moved to a replica; and monitor agent/database memory growth and OOM events so an intentional or accidental trigger is detected early. Because the published vector shows PR:N while a valid authenticated connection is realistically required per our assessment, do not treat network reachability alone as a control - verify authentication and least-privilege boundaries as well.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-400 (Uncontrolled Resource Consumption) is the root-cause class: rather than corrupting or leaking data, the defect causes the Db2 engine to allocate memory without an effective bound while executing certain queries against multi-dimensional clustering (MDC) tables. MDC tables physically group rows into blocks along multiple dimensions and depend on block indexes and composite block maps during scans and joins; the query paths exercised in the affected builds mishandle memory accounting in that machinery, so an otherwise ordinary query can exhaust instance memory and take down the database or the affected agent/connection. CPE data identifies the affected package as IBM Db2 (cpe:2.3:a:ibm:db2) across the 11.5.x and 12.1.x lines, specifically 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 (EUVD-2026-32489). The CVSS:3.1/AV:N/AC:L/UI:N profile means the triggering workload can arrive over normal network database connectivity rather than requiring local access, and the S:U/C:N/I:N/A:H scoring confirms the primitive is availability-only; the realistic blast radius is bounded by the memory the Db2 instance is permitted to consume.
Know when Db2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Executing queries against MDC tables requires an authenticated database session, so PR:L rather than PR:N; impact is availability-only (A:H), with no C or I impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to running out of memory when executing certain queries with MDC tables.
Executive ViewAI
IBM Db2 releases 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 are exposed to an availability flaw in which crafted SQL against multi-dimensional clustering (MDC) tables can exhaust database memory and degrade or halt service; there is no confidentiality or integrity impact. Business exposure is limited to availability of Db2-dependent applications, and only where MDC tables are actually deployed and a user with valid credentials can submit queries. Exploitation status is low-urgency: no public exploit identified at time of analysis, no confirmed actively exploited (CISA KEV) status, and an assessed attack vector requiring authentication (PR:L), though the published CVSS vector lists PR:N.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict database connections to least-privilege, business-justified accounts (authenticated access is realistically required per the assessed PR:L vector); confirm whether MDC tables are in use, since deployments without them are not reachable; apply Db2 workload management resource caps and monitor memory usage with alerting; migrate MDC tables to range-partitioned table organizations where feasible; maintain instance restart/recovery procedures and memory headroom to limit outage duration.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Stack-based buffer overflow in the SQL/PSM (aka SQL Persistent Stored Module) Stored Procedure (SP) infrastructure in IB
IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a stack-bas
Stack-based buffer overflow in IBM DB2 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on Linux
IBM DB2 9.5 uses world-writable permissions for nodes.reg, which has unspecified impact and attack vectors. Rated critic
Remote code execution in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 lets unauthenticated network attackers run arbitrary co
Privilege escalation in IBM Db2 (data server versions 11.5.0-11.5.9 and 12.1.0-12.1.5) allows an attacker to submit a sp
Memory-corruption in IBM Db2's IXF file IMPORT parser lets an attacker supply a crafted IXF data file that overflows a s
Stack-based buffer overflow in the Java Stored Procedure infrastructure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7
Directory traversal vulnerability in the UTL_FILE module in IBM DB2 and DB2 Connect 10.1 before FP1 on Windows allows re
IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system
Integer signedness error in the db2dasrrm process in the DB2 Administration Server (DAS) in IBM DB2 9.1 through FP11, 9.
The Stored Procedure infrastructure in IBM DB2 9.5, 9.7 before FP9a, 10.1 before FP3a, and 10.5 before FP3a on Windows a
Exploit-DB