What is the CVSS score of CVE-2026-7771?

CVE-2026-7771 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-7771?

Yes, a patch is available for CVE-2026-7771. Update the affected software to the latest version immediately.

IBM Db2 CVE-2026-7771

EUVD-2026-45283 MEDIUM

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2026-07-17 ibm

GHSA-g7p2-92pc-3r27

IBM Denial Of Service Db2

5.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI

5.0 MEDIUM

Submitting SQL to Db2 requires at minimum a database session (PR:L); all other metrics match IBM's published vector.

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 19:52 vuln.today

DescriptionCVE.org

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a trap when compiling a specially crafted statements containing subqueries could lead to a denial of service.

AnalysisAI

Denial of service in IBM Db2 11.5.x and 12.1.x allows a local database user to crash the database engine by submitting specially crafted SQL statements containing subqueries that trigger an infinite loop (CWE-835) in the query compiler. The vulnerability spans two active major release lines - 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 - covering a broad swath of IBM's current Db2 product lifecycle. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch via the vendor advisory.

Technical ContextAI

IBM Db2 is an enterprise relational database management system widely deployed in financial, government, and IBM-ecosystem environments. The vulnerability resides in the SQL query compiler - specifically the code path that processes statements containing subqueries. CWE-835 (Loop with Unreachable Exit Condition) indicates that certain subquery constructs cause the compiler to enter a loop from which it cannot exit, consuming CPU resources until the process traps. In Db2 terminology, a 'trap' is a fatal internal assertion or unrecoverable error condition that terminates the database instance. The CPE string cpe:2.3:a:ibm:db2:*:*:*:*:*:*:*:* covers the full IBM Db2 software product across the affected version ranges. The CVSS local attack vector (AV:L) indicates the triggering SQL must be submitted through a local or authenticated database session rather than a purely anonymous remote channel.

RemediationAI

IBM has released a patch addressing this vulnerability; the exact fix pack and build numbers for both the 11.5.x and 12.1.x release lines must be obtained directly from the vendor advisory at https://www.ibm.com/support/pages/node/7279480, as the specific fixed version number was not included in the available intelligence data. As a compensating control while patching is scheduled, restrict database session access to trusted and explicitly authorized users, auditing SQL execution and DDL compilation privileges to reduce the population capable of submitting arbitrary queries. Blocking subquery-containing SQL via application-layer filtering is not a reliable general workaround due to the breadth of legitimate subquery usage, but could be applied narrowly in high-risk batch processing contexts. Restricting network access to the Db2 listener to authorized hosts reduces the exposure window for remote database connections leading to this local-class exploit.