IBM Db2 11.5 and 12.1 releases are affected by a flaw where improper input validation can let a local attacker trigger a denial of service. The vulnerability does not compromise confidentiality or integrity; it simply causes the database engine to terminate or become unresponsive. The issue involves logical errors in how certain inputs are processed, classified as CWE-20, and manifests only when locally‑privileged users supply specially crafted data.

Affected are IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 running on AIX and Linux. The fix applies to all levels of these releases; IBM recommends downloading the latest security update for each release: V11.5.9 for 11.5 series and V12.1.4 or V12.1.5 (including update #94858 or later) for the 12.1 series.

The CVSS score of 3.3 indicates low severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, underscoring its low exploitation likelihood. The fault requires local access to the Db2 instance; no remote network attack vector is disclosed. An attacker would need to supply malformed input to the database engine to trigger the crash, and the impact is limited to service disruption rather than data compromise.