The vulnerability is a race condition that occurs when IBM Db2 Mirror for i creates a Unix domain socket using a predictable path in a directory that is world‑writable. A local attacker who can write to that directory could manipulate the timing of socket creation to read data that should be restricted, leading to the disclosure of sensitive information. The flaw is identified as CWE‑367 and does not provide any remote code execution or privilege escalation capabilities. The impact is limited to information disclosure for users who have write access to the affected directory.

IBM Db2 Mirror for i is affected in the 7.4, 7.5, and 7.6 releases. The publicly disclosed patches for these versions are identified by the PTF numbers SJ11153, SJ11193, and SJ11207 for 7.4; SJ11152, SJ11194, and SJ11206 for 7.5; and SJ11151, SJ11195, and SJ11205 for 7.6.

The CVSS score of 4.4 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting a lower likelihood of widespread exploitation. The attack vector is local; a threat actor must have local write access to the world‑writable directory used for socket creation. In the absence of that permission, the race condition cannot be triggered. Therefore, while the condition is exploitable, it requires a reasonably privileged local attacker and is therefore considered a moderate risk rather than a high‑severity threat.