Description

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-04T17:16:52.117Z",
  "pubdate": "2026-09-04T17:16:52.117Z",
  "executiveSummary": "This vulnerability concerns an out-of-bounds read flaw identified in IBM Db2 Mirror for i, affecting versions 7.4, 7.5, and 7.6.\nThe vulnerability allows a remote, unauthenticated attacker to induce a denial-of-service (DoS) condition on the affected system.\nAn out-of-bounds read occurs when software reads data past the end or before the beginning of the intended buffer, potentially resulting in the disclosure of sensitive memory contents or, as in this specific case, triggering a system exception that leads to a service crash.\nThe risk implication is significant as it facilitates service disruption, impacting the availability of the IBM Db2 Mirror environment.\nExploitation does not inherently require high-level privileges, as the attack vector is remote in nature.\nOrganizations relying on IBM Db2 Mirror for high availability and continuous data replication are advised to evaluate the exposure of their database mirroring interfaces and monitor for available vendor security patches.",
  "technicalDetails": "The vulnerability manifests as an out-of-bounds read within IBM Db2 Mirror for i. This flaw occurs when the application processes malformed packets or requests that trigger an internal function to access memory outside of the allocated buffer boundaries.\nIn the context of network-based services like IBM Db2 Mirror, such vulnerabilities typically arise during the parsing of complex protocol headers or data structures where input length validation is insufficient or improperly implemented.\nThe attack flow begins when an attacker sends a specially crafted, malicious network request to the IBM Db2 Mirror listener port. The receiving component, failing to perform adequate bounds checking on the input data, attempts to process the payload by reading memory at an offset dictated by the attacker-controlled input.\nBecause the read operation accesses memory addresses outside of the memory segment specifically allocated for the current data structure, the process triggers an access violation or a segmentation fault. Given the critical nature of the Db2 Mirror service, this memory access error forces an unhandled exception within the system process, leading to a termination of the service or a complete system hang, effectively achieving a denial-of-service state.\nThe vulnerability affects versions 7.4, 7.5, and 7.6 of the IBM Db2 Mirror for i product. The exploitation is facilitated by the product's remote accessibility, allowing attackers to reach the vulnerable component over the network without requiring prior authentication. The post-exploitation impact is characterized primarily by the loss of availability, which is critical for systems utilizing Db2 Mirror for synchronized data replication across nodes.\nThis type of vulnerability is often rooted in common programming errors where the size of the received buffer is assumed to be compliant with fixed-length data structures, failing to account for truncated or oversized payloads. When the system attempts to iterate through these structures based on the metadata contained within the malicious packet, it reads memory addresses that contain heap or stack data. If the read operation targets an unmapped or protected memory page, the runtime environment terminates the process to maintain system integrity, resulting in the successful DoS outcome."
}