IBM Db2 CVE-2026-6053

Exploitation requires three concrete conditions to be met simultaneously: (1) the attacker must have a valid, low-privileged database account with sufficient rights to execute queries (PR:L per CVSS vector - unauthenticated access is not sufficient); (2) the Db2 instance must be local to the attacker or accessible via a local session (AV:L - this is not remotely exploitable over the network without an established database connection); and (3) the targeted database must contain range partitioned tables, as the vulnerability is specifically triggered through that table type. Environments that do not use range partitioning are not exploitable. Exploitation is limited by the need for existing database credentials and local access, which significantly narrows the realistic threat actor population to insiders, compromised accounts, or attackers who have already achieved local database access through another means.

The CVSS 5.5 Medium score reflects genuine structural constraints on exploitability. The local attack vector (AV:L) and low-privilege requirement (PR:L) together mean an attacker must already hold authenticated database credentials and local system or network access to Db2 - a significant prerequisite that materially reduces the exposed population compared to a network-vector vulnerability. Attack complexity is low (AC:L), meaning no race condition or special circumstance is required beyond triggering the query. Impact is limited exclusively to availability (A:H), with no confidentiality or integrity implications. No EPSS data was provided in the source intelligence, and the vulnerability carries no KEV designation and no known public exploit code, further reducing urgency. Real-world priority is moderate: in multi-tenant or shared Db2 environments where low-privileged users have query access and the database uses range partitioned tables, a malicious or compromised insider could force a database outage. Standalone or tightly access-controlled deployments face substantially lower risk. This is not a high-urgency remediation unless range partitioned tables are in active use by untrusted database principals.

A low-privileged database user - such as a developer account, a compromised application service account, or a malicious insider - authenticates to an IBM Db2 instance and submits a specially crafted SQL query targeting a range partitioned table. No public exploit code exists at time of analysis, but the low attack complexity rating suggests the trigger condition is straightforward once the query structure is known. The Db2 engine fails to bound resource consumption during query execution, causing it to become unresponsive or crash, denying service to all other database clients.