CVE-2026-104332

5.5Medium

Published 12 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash

5.5Medium

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on availability
Weakness: CWE-121

Impact

A local authenticated attacker can crash the database service by running a specially crafted query against a Materialized Query Table (MQT). They need valid credentials to execute queries locally on the Db2 instance.

Root cause

A stack-based buffer overflow occurs during the processing of queries referencing Materialized Query Tables.

Affected systems

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Apply the vendor fix pack from IBM advisory node 7291614 once available; in the interim, restrict query privileges on Materialized Query Tables to trusted users.

shell

$ db2level

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table

References

https://www.ibm.com/support/pages/node/7291614

Source: nvd.nist.gov/vuln/detail/CVE-2026-104332