The vulnerability is an improper authorization flaw in a database SQL procedure that permits a local attacker to delete historic flight‑recorder archives stored by Db2 Mirror for i. The impact is a loss of integrity for the archived data, potentially obscuring critical operational logs. Because the bug is activated by executing the specific procedure, the damage is limited to the scope of the mirrored database and its stored archives, but the absence of those logs can hinder troubleshooting and forensic investigations.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 are affected. The fix is distributed in IBM i release specific PTFs: for 7.4 the PTFs are SJ11153, SJ11193, and SJ11207; for 7.5 they are SJ11152, SJ11194, and SJ11206; for 7.6 they are SJ11151, SJ11195, and SJ11205.

The CVSS score of 4.3 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting current exploitation risk is limited. The likely attack vector is local; an attacker must reach the IBM i system with sufficient privileges to run the SQL procedure or to execute the PTFs. Real‑world exploits are not reported, so the primary risk is that a legitimate or compromised local user could intentionally or accidentally erase historical flight records.