The vulnerability allows a local attacker with access to a vulnerable IBM Db2 installation to use the db2pd utility to gain higher privileges, potentially enabling full system control. The flaw is a classic privilege escalation weakness, classified as CWE-269, and could enable modification of system settings or data. The CVSS score of 6.5 indicates a moderate severity impact but the ability to elevate privileges remains a serious threat, especially in environments where administrators rely on strong segregation of roles.

IBM Db2 releases 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 are affected on both AIX and Linux platforms. The specific releases that have patch availability include version 11.5.9 for the 11.5 line and 12.1.4/12.1.5 for the 12.1 line. Administrators can apply the security updates listed in Fix Central for the corresponding release levels to remediate the issue.

The CVSS score of 6.5 reflects a moderate risk, and there is no EPSS score information available to indicate current exploitation probability. The vulnerability is not listed in CISA KEV, suggesting it has not yet been widely exploited in known campaigns. Because the attack requires local access and manipulation of the db2pd utility, an attacker must already have a foothold on the machine, such as a user account with limited privileges, to exploit the flaw. Once accessed, an attacker could elevate privileges and bypass security controls on the affected Db2 system.