The vulnerability arises from an insecure mechanism used by IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 to verify the integrity of data during transmission, which could allow an attacker to modify or corrupt data. The weakness corresponds to CWE‑353, reflecting a failure to protect data authenticity and integrity. Consequently, an attacker could potentially alter stored information, leading to incorrect database recovery or loss of reliable backup data.

IBM Db2 Recovery Expert for Linux, Unix and Windows, version 5.5 IF 2. The affected builds are reflected in the CPEs for version 5.5.0 and 5.5 IF 2 across all supported operating systems.

The assessed CVSS score is 5.3, indicating moderate severity, while the EPSS score is less than 1 %, suggesting a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be an exploitation of the data transmission path used by the software, although the description does not explicitly detail the attacker’s entry method.