IBM Db2 EUVD-2026-51250

Exploitation requires a local, authenticated OS session on a host running a vulnerable version of IBM Db2 (11.5.0-11.5.9 or 12.1.0-12.1.4) and the ability to execute the db2flacc binary directly, which is available to any standard OS user account (PR:L per CVSS). No Db2 database credentials, administrative database role, or special configuration state is required. Remote unauthenticated exploitation is not possible - the attack vector is strictly local (AV:L). Exploitation is further constrained by SSVC automatable: no, meaning scripted mass exploitation across multiple targets is not straightforwardly achievable. The primary limiting factor for most organizations is the prerequisite of local shell access to the Db2 host itself.

The CVSS 3.1 score of 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects the serious impact potential: any local user can trigger the overflow without user interaction, achieving full confidentiality, integrity, and availability compromise against the Db2 instance. However, real-world exploitation probability is low - EPSS sits at just 0.12% (2nd percentile), and SSVC rates exploitation as none and automatable as no, confirming no evidence of active or mass exploitation. SSVC technical impact is total, consistent with the CVSS high-impact ratings. The AV:L constraint is the primary risk reducer: remote unauthenticated exploitation is impossible, limiting realistic attacker population to those with local shell access on the Db2 host. Priority is highest for organizations running Db2 on shared multi-tenant systems, jump boxes, or environments where non-administrative users hold local OS accounts on database servers. For tightly access-controlled, single-tenant deployments where only authorized DBAs have shell access, urgency is lower but patching remains recommended.

A standard OS user with a shell account on the Db2 server invokes the db2flacc setgid binary with a crafted argument or input value exceeding the bounds of an internal stack buffer. The overflow corrupts the saved return address, redirecting execution to attacker-controlled shellcode or a ROP chain that runs under the elevated group identity of db2flacc, granting the attacker control over Db2 instance files and administrative data without any database credentials. No public proof-of-concept code has been identified at time of analysis.