EUVD-2026-97813
GHSA-mc63-mc2v-x24w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege local Db2 access
-
ExploitSubmit malformed/crafted input
-
ExecutionTrigger improper input validation (CWE-20)
-
ImpactDisrupt database service availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the attacker to already possess authenticated local access to the Db2 host or instance with at least low-level privileges (per AV:L and PR:L) and the ability to submit input to the vulnerable component; it cannot be triggered remotely or by an unauthenticated user. The description does not name a specific feature, protocol, or non-default configuration that must be enabled, so the limiting factors are the local attack vector and the required pre-existing low-privilege authentication rather than a particular deployment mode. Affected deployments are Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5. |
| Impact | This is a low-priority, low-real-risk issue despite being a named CVE. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) scores only 3.3 (Low) and requires local access plus existing low-level privileges (PR:L), which sharply limits the attacker population to users who already hold authenticated access to the Db2 host or instance. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no signal of active or probable near-term exploitation. One notable inconsistency: the description characterizes the impact as a denial of service, yet the provided CVSS vector sets A:N (no availability impact) and instead assigns I:L (low integrity impact) - these two signals conflict, and the vector should be verified with IBM because a true DoS normally maps to an availability (A:L/A:H) rather than integrity impact. Overall this is a high-CVSS-product (widely deployed database) but genuinely low-severity flaw that warrants routine patching, not emergency response. |
| Exploit ScenarioDerived | A user who already has authenticated, low-privilege local access to a Db2 server submits specially crafted input that the database fails to validate properly (CWE-20), causing the affected process to malfunction or terminate and interrupting database service for other users. No public exploit code was identified, and the local vector plus required privileges (AV:L/PR:L) mean this cannot be triggered by an anonymous remote attacker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Improper input validation in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 lets a local attacker who already holds authenticated low-privilege access to the database host or instance disrupt the affected component, resulting in a limited availability impact. The issue is not remotely reachable and cannot be triggered by an unauthenticated user; our assessment rates it CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, a low-severity availability-only condition, and there is no public exploit identified at time of analysis. Overall this is a low-priority, low-real-risk issue despite being a named CVE, and vendor patching is available.
RemediationAI
IBM has released a vendor patch for this issue, and the fix is documented in the IBM support advisory at https://www.ibm.com/support/pages/node/7291615; apply the corrected build for your Db2 11.5.x or 12.1.x maintenance stream (exact fix version is not stated in the supplied data, so confirm the target level against that advisory before upgrading). Patch available per vendor advisory. Where immediate upgrade is not feasible, the practical exposure is bounded by the fact that exploitation requires pre-existing local authenticated access, so the highest-value compensating controls are tightening least privilege on the Db2 host: revoke unnecessary OS and database group memberships, restrict interactive shell and local sqllib/bin execution to database administrator roles, and limit shared local accounts on the database server. Isolation controls such as running the instance under a dedicated low-trust account or container, and forward-monitoring for abnormal Db2 process termination or error-log spikes following local user activity, can detect or constrain abuse but add operational overhead and do not eliminate the flaw. Because the vector is local, network-level filtering (firewalls, port blocking) provides no meaningful mitigation here and should not be used as a substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is classified as CWE-20 (Improper Input Validation), meaning Db2 accepts or mishandles a malformed or unexpected input value within one of its local processing paths without adequately validating its type, length, or structure before use. The affected code sits in the Db2 server engine itself, identified in the CPE data as cpe:2.3:a:ibm:db2, spanning the 11.5.x and 12.1.x release trains. Because the exploitation path is local (AV:L) and requires an existing authenticated identity with at least low privileges (PR:L), the vulnerable surface is the local command, utility, or SQL/API interface reachable by a user who is already logged into the host or connected to the instance - not a network-facing listener. The vendor's CVSS vector marks an integrity impact (I:L) while our independent assessment treats the practical outcome as an availability impact (A:L); both readings agree the scope is unchanged, no confidentiality loss occurs, and no user interaction is required. Versions prior to 11.5.0 are outside the stated affected range.
Know when Db2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Local vector and low existing privileges (AV:L/PR:L) with no user interaction; description indicates a denial of service, so impact is availability (A:L) rather than the input's inconsistent I:L.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due to improper input validation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Stack-based buffer overflow in the SQL/PSM (aka SQL Persistent Stored Module) Stored Procedure (SP) infrastructure in IB
IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a stack-bas
Stack-based buffer overflow in IBM DB2 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on Linux
IBM DB2 9.5 uses world-writable permissions for nodes.reg, which has unspecified impact and attack vectors. Rated critic
Remote code execution in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 lets unauthenticated network attackers run arbitrary co
Privilege escalation in IBM Db2 (data server versions 11.5.0-11.5.9 and 12.1.0-12.1.5) allows an attacker to submit a sp
Memory-corruption in IBM Db2's IXF file IMPORT parser lets an attacker supply a crafted IXF data file that overflows a s
Stack-based buffer overflow in the Java Stored Procedure infrastructure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7
Directory traversal vulnerability in the UTL_FILE module in IBM DB2 and DB2 Connect 10.1 before FP1 on Windows allows re
IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system
Integer signedness error in the db2dasrrm process in the DB2 Administration Server (DAS) in IBM DB2 9.1 through FP11, 9.
The Stored Procedure infrastructure in IBM DB2 9.5, 9.7 before FP9a, 10.1 before FP3a, and 10.5 before FP3a on Windows a
Exploit-DB