CVE-2026-18166: IBM® Db2® is vulnerable to arbitrary library loading via the CREATE WRAPPER command, allowing a privileged database user to read sensitive files from the host filesystem
DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitive information due to improper authorization when using the CREATE WRAPPER command.
Other sources
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitive information due to improper authorization when using the CREATE WRAPPER command.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Db2to a version that resolves this vulnerability.Fixed in 11.5.9Patch Security Update #94236 - Upgrade
Upgrade
IBM Db2to a version that resolves this vulnerability.Fixed in 12.1.4Patch Security Update #94722 - Upgrade
Upgrade
IBM Db2to a version that resolves this vulnerability.Fixed in 12.1.5Patch Security Update #94858
Event History
Frequently Asked Questions
Which Db2 deployments are affected?
The affected releases are IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX, and Windows, including Db2 Connect Server.
What access does an attacker need?
An attacker must be remotely authenticated and have the database privileges needed to use the CREATE WRAPPER command. No user interaction is required.
What is the impact of successful exploitation?
A successful attacker can load arbitrary libraries through CREATE WRAPPER and read sensitive files from the host filesystem. The stated impact is disclosure of sensitive information; integrity and availability impacts are not indicated.