Description
IBM Db2 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to cause a denial of service due to a memory leak.
Published: 2026-08-12
Score: 3.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

IBM Db2 12.1.5 for Linux, UNIX and Windows contains a memory leak that can be triggered by a local attacker, causing the database process to consume progressively more memory until it exhausts available resources and terminates. This fault leads to a denial of service, disrupting database availability. The weakness is categorized as CWE‑770, a failure to properly manage memory.

Affected Systems

All versions of IBM Db2 12.1 that are not upgraded to version 12.1.5 (including the Db2 Connect Server) on Linux, UNIX and Windows are affected. The vulnerability is local, so it requires the attacker to have access to the host where the database service is running.

Risk and Exploitability

The CVSS score of 3.3 indicates a low severity and the EPSS score is not available; the vulnerability is not listed in CISA KEV. Exploitation requires local access and the ability to invoke the database service. While the low score and local attack vector reduce the immediate risk compared to remote exploits, the impact on availability can be significant for critical systems and mitigations should still be applied promptly.

Generated by OpenCVE AI on August 13, 2026 at 01:54 UTC.

Remediation

Vendor Solution

Customers running any vulnerable affected level of an affected Program, V12.1, can download the security update containing the interim fix for this issue from Fix Central. These security updates are available based on the most recent level for each impacted release: V12.1.5. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URL V12.1  TBD https://www.ibm.com/support/pages/node/7282633 IBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.

OpenCVE Recommended Actions

  • Apply the security update for Db2 12.1.5 from IBM Fix Central that contains the interim fix for the memory‑leak issue.
  • Ensure that all components of the affected Db2 release, including the Db2 Connect Server, are updated to 12.1.5 or later.
  • Restrict local user privileges to enforce the principle of least privilege, limiting the ability to trigger the memory leak.
  • Monitor database server memory usage for abnormal growth patterns to detect potential exploitation.

Generated by OpenCVE AI on August 13, 2026 at 01:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 17 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:ibm:db2:12.1.5:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1.5:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:12.1.5:*:*:*:*:windows:*:*

Thu, 13 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 12 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
Description IBM Db2 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to cause a denial of service due to a memory leak.
Title IBM® Db2® could allow a local attacker to cause a denial of service due to a memory leak
First Time appeared Ibm
Ibm db2
Weaknesses CWE-770
CPEs cpe:2.3:a:ibm:db2:12.1.5:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm db2
References
Metrics cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Ibm Db2
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-13T14:08:28.076Z

Reserved: 2026-07-28T17:11:56.662Z

Link: CVE-2026-18096

cve-icon Vulnrichment

Updated: 2026-08-13T14:08:18.736Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-12T21:17:36.813

Modified: 2026-08-17T17:28:15.660

Link: CVE-2026-18096

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T02:00:13Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling