CVE-2026-10535: IBM® Db2® is vulnerable to buffer overflow in setgid helper db2flacc which can lead to privilege escalation and instance compromise from an unprivileged shell
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc.
Other sources
IBM Db2 is vulnerable to buffer overflow in setgid helper db2flacc.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Db2 modpack special interim fix (Fix Central)to a version that resolves this vulnerability.Fixed in V11.5.9 - Upgrade
Upgrade
IBM Db2 modpack special interim fix (Fix Central)to a version that resolves this vulnerability.Fixed in V12.1.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10535?
The severity of CVE-2026-10535 is rated high with a score of 8.4.
How do I fix CVE-2026-10535?
To fix CVE-2026-10535, update IBM Db2 to the latest version provided by IBM to mitigate the buffer overflow vulnerability.
What are the potential impacts of CVE-2026-10535?
CVE-2026-10535 can lead to privilege escalation and instance compromise from an unprivileged shell due to the buffer overflow vulnerability.
Which versions of IBM Db2 are affected by CVE-2026-10535?
IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 are affected by CVE-2026-10535.
What type of vulnerability is CVE-2026-10535 classified as?
CVE-2026-10535 is classified as a buffer overflow vulnerability.