IBM Db2 EUVD-2026-45283

Exploitation requires a local system foothold on the IBM Db2 host or an active database session capable of submitting SQL statements for compilation. The CVSS vector (AV:L/PR:N/UI:R) indicates a local attack surface with user interaction required - the compile action must be actively initiated by a user, suggesting the crash is triggered during a client-initiated query preparation or execution phase. The SQL statement must contain subqueries structured in a way that exercises the defective compiler code path. Exploitation is strictly limited to IBM Db2 versions 11.5.0-11.5.9 and 12.1.0-12.1.4; other database platforms and out-of-range Db2 versions are not affected. Impact is limited entirely to availability - no data exfiltration or integrity compromise is possible through this vulnerability.

The CVSS 5.5 Medium score reflects a local, availability-only denial-of-service scenario with no confidentiality or integrity impact (C:N/I:N/A:H). The AV:L attack vector significantly constrains exploitability - the attacker must have a local system foothold or an active database session. UI:R further limits exploitation to scenarios where a user must actively initiate the compile action. No EPSS score is present in the available data, no CISA KEV listing exists, and no public exploit code has been identified - all signals that align with a low-urgency, routine patch cycle prioritization rather than emergency response. The primary real-world threat model is an insider or a compromised low-privilege database account intentionally causing service disruption. The absence of confidentiality and integrity impact means this is purely an availability risk. CVSS PR:N is notable - the IBM-published vector claims no privileges are required despite database session access being a practical prerequisite; security teams should verify whether unauthenticated local paths to the compiler exist or whether PR:L is more accurate for their deployment.

A local user with an active IBM Db2 database session constructs a SQL statement embedding a specially structured subquery pattern and submits it for compilation. The Db2 query compiler enters a CWE-835 unreachable-exit loop, consuming CPU resources until the database process traps and terminates - taking down the entire Db2 instance and denying service to all connected users. No public exploit code has been identified; the trigger is a crafted SQL string requiring no special tools.