Most severe vulnerabilities for "ibm ibm® db2®"

IBM Db2 for Windows 12.1.0 - 12.1.3 could allow a local user with filesystem access to escalate their privileges due to the use of an unquoted search path element.

1 / 2

Source: MITRE

Remedy

Customers running any vulnerable affected level of an affected Program, V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V12.1.2 and V12.1.3. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV12.1 TBD https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads Special Build #71609 or later for V12.1.3 available at this link: https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-36384

IBM DB2IBM® Db2® is vulnerable to buffer overflow in setgid helper db2flacc which can lead to privilege escalation and instance compromise from an unprivileged shell

Risk 74

Severity

8.4

Buffer Overflow

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc.

1 / 2

Source: MITRE

First published (updated )

CVE-2026-10535

IBM IBM® Db2®IBM Db2 XML External Entity Reference

Risk 54

Severity

8.2

XEE

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

1 / 2

Source: NVD

Remedy

Customers running any vulnerable modpack level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, V12.1.2 and V12.1.3. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1 TBD https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads Special Build #74153 or later for V12.1.3 available at this link: https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-36247

IBM IBM® Db2®IBM® Db2® is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions

Risk 60

Severity

8.1

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions.

1 / 2

Source: MITRE

First published (updated )

CVE-2026-87958

IBM DB2IBM Db2 privilege escalation

Risk 69

Severity

7.8

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

IBM Db2 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) under specific configurations could allow a local user to execute malicious code that escalate their privileges to root due to execution of unnecessary privileges operated at a higher than minimum level.

1 / 2

Source: MITRE

Remedy

Remediation/Fixes Customers running any vulnerable affected level of an affected Program, V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V12.1.2 and V12.1.3. They can be applied to any affected level of the appropriate release to remediate this vulnerability. Release Fixed in mod pack APAR Download URL V12.1 V12.1.3 DT445866 Special Build #70120 or later for V12.1.2 available at this link: https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads IBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability. Note: After December 31, 2025, 11.1 and 10.5 versions of Db2 will not have security fixes made available as they will reach EoS.

First published (updated )

CVE-2025-36186

IBM DB2IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control

Risk 51

Severity

7.8

EPSS

0.17%

Code Injection

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

IBM Data Server Driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control.

1 / 2

Source: IBM

First published (updated )

CVE-2026-9762

IBM Db2 for Linux, UNIX and WindowsIBM Db2 Denial of Service

Risk 43

Severity

7.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query with XML columns.

1 / 2

Source: NVD

Remedy

Customers running any vulnerable modpack level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, V12.1.2, and V12.1.3. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1 TBD https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads Special Build #71609 or later for V12.1.3 available at this link: https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-36442

IBM Db2 for Linux, UNIX and WindowsIBM Db2 Privilege Escalation

Risk 70

Severity

7.5

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 under specific configuration of cataloged remote storage aliases could allow an authenticated user to execute unauthorized commands due to an authorization bypass vulnerability using a user-controlled key.

1 / 2

Source: MITRE

Remedy

Customers running any vulnerable modpack level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, and V12.1.2. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1 TBD https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-36365

IBM Db2 for Linux, UNIX and WindowsIBM Db2 Denial of Service

Risk 43

Severity

7.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as a trap may occur when selecting from certain types of tables.

1 / 2

Source: NVD

Remedy

Customers running any vulnerable modpack level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, and V12.1.2. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1 v12.1.3 https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads 12.1.3 Latest https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-36070

IBM IBM® Db2®IBM® Db2® federated server could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands under certain conditions

Risk 70

Severity

7.5

Buffer Overflow

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands on Db2 clients due to a stack-based buffer overflow that improperly copies user-controlled data into a fixed-size stack buffer without bounds checking.

1 / 2

Source: MITRE

First published (updated )

CVE-2026-86093

IBM DB2IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive informati…

Risk 44

Severity

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information when using ADMINCMD with LOAD or BACKUP.

1 / 2

Source: IBM

First published (updated )

CVE-2021-29825

IBM Db2 for Linux, UNIX, and WindowsIBM Db2 Privilege Escalation

Risk 66

Severity

7.2

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 could allow an instance owner to execute malicious code that escalate their privileges to root due to execution of unnecessary privileges operated at a higher than minimum level.

1 / 2

Source: NVD

Remedy

First published (updated )

CVE-2025-36184

IBM DB2IBM® Db2® is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data.

Risk 48

Severity

7.1

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data.

1 / 2

Source: MITRE

First published (updated )

CVE-2026-16480

IBM IBM® Db2®IBM Db2 code execution

Risk 63

Severity

6.7

Buffer Overflow

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 with a Federated configuration is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user with SYSADM privileges could overflow the buffer and execute arbitrary code on the system. IBM X-Force ID: 257763.

1 / 2

First published (updated )

CVE-2023-35012

IBM Db2 for Linux, UNIX and WindowsIBM Db2 Denial of Service

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM® Db2® is vulnerable to a denial of service with a specially crafted query that uses ALTER TABLE operations.

Remedy

Customers running any vulnerable modpack level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, V12.1.2 and V12.1.3. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1TBD https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads Special Build #71609 or later for V12.1.3 available at this link: https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-36407

IBM Db2 for Linux, UNIX and WindowsIBM Db2 Denial of Service

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic.

1 / 2

Source: MITRE

Remedy

Customers running any vulnerable modpack level of an affected Program, V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V12.1.2 and V12.1.3. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV12.1TBD https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads Special Build #71609 or later for V12.1.3 available at this link: https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-36423

IBM DB2IBM Db2 Denial of Service

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 is vulnerable to a denial of service as the server may crash when an authenticated user creates a specially crafted query.

1 / 2

Source: NVD

Remedy

Customers running any vulnerable affected level of an affected Program, V11.5 can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent affected level for each impacted release: V11.5.9. They can be applied to any affected mod pack level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1V12.1.2 & V12.1.3 https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads 12.1.3 Latest https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-2668

IBM Db2 for Linux, UNIX and WindowsIBM Db2 Denial of Service

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service using a specially crafted SQL statement including XML that performs uncontrolled recursion.

1 / 2

Source: NVD

Remedy

Customers running any vulnerable modpack level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, and V12.1.2. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1 v12.1.3 https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads 12.1.3 Latest https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-36001

IBM Db2 for Linux, UNIX and WindowsIBM Db2 Denial of Service

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic.

1 / 2

Source: IBM

Remedy

Customers running any vulnerable modpack level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, V12.1.2, and V12.1.3. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1 TBD https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads Special Build #71609 or later for V12.1.3 available at this link: https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-36427

IBM Db2 for Linux, UNIX and WindowsIBM Db2 Denial of Service

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a denial of service due to excessive use of a global variable.

1 / 2

Source: MITRE

Remedy

Customers running any vulnerable modpack level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, V12.1.2 and V12.1.3. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1 TBD https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads Special Build #71609 or later for V12.1.3 available at this link: https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-36009

IBM Db2 for Linux, UNIX and WindowsIBM Db2 Denial of Service

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 could allow an authenticated user to cause a denial of service when given specially crafted query.

1 / 2

Source: MITRE

Remedy

Customers running any vulnerable modpack level of an affected Program, V11.5 , can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 IBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.

First published (updated )

CVE-2025-36387

IBM Db2 for Linux, UNIX and WindowsIBM Db2 Denial of Service

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service by executing a query that invokes the JSONObject scalar function, which may trigger an unhandled exception leading to abnormal server termination.

Remedy

Customers running any vulnerable modpack level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, V12.1.2 and V12.1.3. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1TBD https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads Special Build #71609 or later for V12.1.3 available at this link: https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-36366

IBM Db2 for Linux, UNIX and WindowsIBM Db2 Denial of Service

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service due to improper neutralization of special elements in data query logic.

Remedy

Customers running any vulnerable modpack level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, V12.1.2 and V12.1.3. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1 TBD https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads Special Build #71609 or later for V12.1.3 available at this link: https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-36424

IBM Db2 for Linux, UNIX and WindowsIBM Db2 Denial of Service

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service due to improper allocation of resources.

1 / 2

Source: NVD

Remedy

Fixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1 v12.1.3 https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads 12.1.3 Latest https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-36098

IBM IBM® Db2®IBM Db2 Denial of Service

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic

1 / 2

Source: NVD

Remedy

First published (updated )

CVE-2025-13867

IBM IBM® Db2®IBM Db2 Denial of Service

Risk 38

Severity

6.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 12.1.0 through 12.1.3 could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic with federated objects.

1 / 2

Source: NVD

Remedy

Customers running any vulnerable modpack level of an affected Program, V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V12.1.2 and V12.1.3. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV12.1 TBD https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads Special Build #74153 or later for V12.1.3 available at this link: https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-14689

IBM IBM® Db2®IBM Db2 Information Disclosure

Risk 38

Severity

6.5

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 could allow an authenticated user to obtain sensitive information under specific HADR configuration.

1 / 2

Source: NVD

Remedy

First published (updated )

CVE-2025-36425

Trending

Versions

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Company

Resources

Contact