The vulnerability is a null pointer dereference that can cause the IBM Db2 federated server to crash when a remote authenticated user executes certain operations. Because the fault is triggered by user input, an attacker can induce a restart of the server, leading to loss of service for all clients connected to the database instance. The weakness maps to CWE-476, indicating an uninitialized reference dereference.

Vulnerable IBM Db2 installations include version 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, Unix, and Windows platforms, including the Db2 Connect Server. Known affected revision levels are 11.5.9, 12.1.4, and 12.1.5, which can be identified by checking the product version string.

The CVSS score of 6.5 classifies the issue as medium severity. The exploit probability is not listed but it is not known to be in available attacks have been confirmed. Attackers would need valid credentials to the database server, and the program requires authenticated remote access to trigger the dereference. The most likely attack path is via injected or malformed federated queries or operations that trigger the server code path responsible for handling authentication.