IBM Db2 Mirror for i EUVD-2026-71488

No special conditions are required - the CVSS vector AV:N/AC:L/PR:N/UI:N indicates remote unauthenticated exploitation against default configurations of IBM Db2 Mirror for i 7.4, 7.5, and 7.6. The primary limiting factor is network reachability: environments that isolate the Db2 Mirror for i replication service to a dedicated private VLAN or restrict it behind a firewall have substantially reduced attack surface. Impact is availability-only (A:L) with no confidentiality or integrity consequences per IBM's assessment. Only the three specified release streams are confirmed affected.

The CVSS 5.3 Medium rating is grounded in a fully unauthenticated, low-complexity network attack path (AV:N/AC:L/PR:N/UI:N) with limited availability impact (A:L) and no confidentiality or integrity exposure. Because no special preconditions are required, even a mid-sized IT operation in bytom running IBM i infrastructure should apply the available patch promptly to avoid a disruptive replication outage. However, the limited blast radius (A:L only - not A:H) indicates the service may partially recover or fail gracefully rather than producing a persistent crash. No EPSS score is provided; the CVE is not listed in the CISA KEV catalog, suggesting no observed active in-the-wild exploitation. The two mislabeled tags ('Buffer Overflow' and 'Information Disclosure') in the input conflict with the CWE-125 classification and C:N CVSS metric respectively - these should not inflate perceived risk beyond what the vector and description support.

An attacker with network access to the IBM Db2 Mirror for i service sends a specially crafted packet that triggers an out-of-bounds read in the service's input-handling routine, causing the mirroring process to crash. The resulting service disruption breaks the HA replication link between production and mirror, leaving the environment without failover protection until the service is manually restarted and replication re-synchronized. No public proof-of-concept exploit has been identified at time of analysis, but the low-complexity, no-authentication attack path makes exploitation straightforward once the service is network-reachable.