Description

IBM Db2 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to cause a denial of service due to a memory leak.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-08-12T21:17:36.813Z",
  "pubdate": "2026-08-12T21:17:36.813Z",
  "executiveSummary": "A denial of service vulnerability exists within IBM Db2 12.1.5 for Linux, UNIX and Windows, which also encompasses DB2 Connect Server. The vulnerability manifests as a memory leak that can be exploited by a local attacker to exhaust system resources, ultimately causing the affected database service to crash or become unresponsive. This security flaw poses a significant risk to system availability and operational continuity within environments relying on the affected database platform. Exploitation of this vulnerability requires local access to the target host running the vulnerable database instance. While remote network access is not strictly required for direct exploitation, successful execution leads directly to a complete denial of service state for the targeted Db2 service, impacting all dependent local and remote database operations.",
  "technicalDetails": "The vulnerability is rooted in improper memory management within IBM Db2 12.1.5 for Linux, UNIX and Windows, specifically involving the handling of resource allocation and deallocation lifecycle routines. When certain operations are repeatedly invoked by a local user, the database engine fails to appropriately release allocated heap or system memory, resulting in a progressive memory leak. Over time, repeated execution of the trigger conditions consumes available system memory resources, leading to resource exhaustion, kernel-level Out-Of-Memory (OOM) killer intervention, or internal database engine failure. The attack flow begins with the local attacker authenticating or accessing the local environment where the database instance is deployed. The attacker then repeatedly interacts with the vulnerable component, triggering the flawed memory allocation routine without subsequent cleanup. As memory consumption scales upward unchecked, the performance degradation transitions into a full denial of service condition. The vulnerable component is part of the core database engine processing routines within IBM Db2 12.1.5 and DB2 Connect Server. Exploitation requires local system access and applicable local privileges to interact with the database binaries or local communication channels, but does not inherently require administrative or root privileges depending on the specific attack vector surface exposed by the memory management flaw. Network exposure is indirect, as the vulnerability itself is triggered via local pathways, yet the resultant denial of service globally impacts database availability across all connected client interfaces."
}