IBM Db2 databases from version 11.5.0 up through 11.5.9 and from 12.1.0 up through 12.1.4 can run out of memory when a query is executed against Multi‑Clustering‑Dimensional (MDC) tables. The excessive memory consumption is caused by the internal handling of these tables, which can lead to complete exhaustion of available system RAM and force the database or host operating system to become unresponsive. This flaw aligns with CWE‑400: Uncontrolled Resource Consumption, where improper allocation of resources results in denial of service. The direct result is a denial of service that could affect any application that relies on the affected Db2 instance. The likely attack vector is the execution of crafted queries against MDC tables, which an attacker could trigger remotely through an application interface or directly if they have SQL access.

IBM Db2 is affected in the V11.5 release at levels 11.5.0 through 11.5.9 and in the V12.1 release at levels 12.1.0 through 12.1.4. IBM has released interim special builds, V11.5.9 for the 11.5 line and V12.1.4 for the 12.1 line, that address the memory exhaustion issue and can be applied to any earlier level within the same release.

The CVSS score of 6.5 indicates moderate severity, and no EPSS score is currently available. The vulnerability is not listed in CISA's KEV catalog. Because the underlying issue is triggered by the execution of certain queries on MDC tables, an attacker would need the ability to submit those queries, either remotely through an application that interfaces with Db2 or locally with database privileges. If such access exists, the risk of a denial of service is high due to the complete consumption of system memory.