The vulnerability allows an attacker to cause an IBM Db2 database to become unavailable by executing a specially crafted query that utilizes a Materialized Query Table. This flaw can be triggered without requiring elevated privileges and results in the database process crashing or repeatedly failing, causing a denial of service. The weakness is categorized as an out‑of‑bounds issue within the query handling code.

Affected products include IBM Db2 for AIX and Linux across release tiers 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5. The security updates that contain the fix are released for V11.5.9 and for V12.1.4 (and also for V12.1.5), and any lower level within each release is vulnerable.

The CVSS score of 5.5 indicates a moderate severity. The EPSS score is not available, which suggests limited public exploitation data, and the vulnerability is not listed in the CISA KEV catalog. The lack of a known exploit does not eliminate risk; a local or remote attacker could gain access to a database and issue the malicious query. Because the flaw is in query parsing, the attack vector is most likely through an application layer that sends crafted SQL to the database.