IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 are affected on Linux, UNIX, and Windows platforms. The vulnerability occurs when the database engine processes specific testcase buckets and writes potentially sensitive information, including credentials, to diagnostic log files. This allows a local user with access to the log files to read the exposed strings, leading to credential theft and potential gain of higher privileges.

Affected vendors and products include IBM Db2 for both enterprise and connect server releases. The impacted product range extends from Db2 11.5.0 to 11.5.9 and from Db2 12.1.0 to 12.1.4, covering all supported operating systems listed in the CVE entry.

The CVSS score of 5.5 indicates moderate severity, primarily because the flaw requires local access; there is no evidence of remote exploitation. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Given that only a local user who can read the diagnostic logs is needed, the risk is elevated for systems with permissive log file permissions or where privileged logs are accessible to ordinary users. The impact centers on confidentiality loss of credentials stored in the logs.