CVE-2025-36071
BaseFortify
Publication date: 2025-07-29
Last updated on: 2025-08-07
Assigner: IBM Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ibm | db2 | From 11.5.0 (inc) to 11.5.9 (inc) |
| ibm | db2 | From 11.5.0 (inc) to 11.5.9 (inc) |
| ibm | db2 | From 11.5.0 (inc) to 11.5.9 (inc) |
| ibm | db2 | From 12.1.0 (inc) to 12.1.2 (inc) |
| ibm | db2 | From 12.1.0 (inc) to 12.1.2 (inc) |
| ibm | db2 | From 12.1.0 (inc) to 12.1.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-772 | The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in IBM Db2 for Linux, UNIX, and Windows occurs when the server processes specially crafted federated queries under certain conditions, causing a denial of service (DoS) by crashing the server due to improper release of memory resources (CWE-772). It affects versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.2. The issue is remotely exploitable with low attack complexity and requires low privileges, but it does not affect confidentiality or integrity, only availability. [1]
How can this vulnerability impact me? :
The vulnerability can cause the IBM Db2 server to crash, resulting in a denial of service. This impacts the availability of the database server, potentially disrupting business operations that rely on it. Since it does not affect confidentiality or integrity, data is not exposed or altered, but the service downtime could affect productivity and system reliability. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should apply the appropriate IBM special interim fix builds for your Db2 version: for 11.5.9, apply Special Build #62071 or later; for 12.1.1, apply Special Build #62100 or later; for 12.1.2, apply the latest special builds available. No other workarounds or mitigations are provided. It is recommended to subscribe to IBM security notifications for future updates. [1]