The vulnerability exists when an authenticated database user with sufficient privileges executes the CREATE WRAPPER command, allowing the database to load an arbitrary shared library. This improper authorization enables the user to read sensitive files from the host operating system, thereby compromising confidentiality. The weakness maps to CWE‑284 which describes unauthorized read and/or write access due to missing or insufficient permission checks.

Products affected are IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX, and Windows platforms, including the DB2 Connect Server. The issue applies to both the core database engine and the server component in the identified release ranges.

The CVSS score of 7.7 indicates a high severity vulnerability, though the EPSS score is not available, so exploitation probability remains uncertain. The vulnerability is hosted in CISA’s KEV catalog as not listed, implying no confirmed widespread exploitation yet. The likely attack vector is remote authenticated access, where a privileged DB user can invoke CREATE WRAPPER and effectively read arbitrary host files. Because the flaw requires database-level privileges, the impact is limited to the host files accessible by the Db2 service account, but it may still expose credential files or other sensitive data. Given the lack of known public exploits, the primary risk stems from the potential for malicious insiders or compromised accounts to leverage the flaw.