CVE-2026-78404

6.5Medium

Published 12 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-269

Impact

A local attacker with low-level system access can escalate privileges and read sensitive data across trust boundaries. They need existing local user access to the host running the utility.

Root cause

Improper privilege management flaw in the db2pd utility allows unauthorized privilege escalation.

Affected systems

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Fix & remediation

Upgrade to a fixed IBM Db2 release newer than 11.5.9 or 12.1.5 per the vendor advisory; as an interim workaround, restrict execution permissions on the db2pd binary to trusted administrative users only.

shell

$ chmod o-rx $(which db2pd)

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility.

References

https://www.ibm.com/support/pages/node/7291612

Source: nvd.nist.gov/vuln/detail/CVE-2026-78404