CVE-2026-104364
3.3LowPublished 12 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-20
Impact
A local attacker with an account on the system can cause a denial of service against the database. They need local system access and low privileges to trigger it.
Root cause
Improper input validation allows local users to crash the Db2 service.
Affected systems
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Fix & remediation
Upgrade to an IBM Db2 release newer than 11.5.9 or 12.1.5 as directed by vendor advisory node/7291615. If patching must wait, restrict local access to the Db2 host to trusted administrators only.
$ db2levelAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due to improper input validation.