Stack-Based Buffer Overflow in IBM Db2

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: IBM Corporation

Description

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands on Db2 clients due to a stack-based buffer overflow that improperly copies user-controlled data into a fixed-size stack buffer without bounds checking.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-86093

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	db2	From 11.5.0 (inc) to 11.5.9 (inc)
ibm	db2	From 12.1.0 (inc) to 12.1.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

This vulnerability is a stack-based buffer overflow in IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5. It occurs when a user-controlled DRDA server endpoint sends data to a Db2 client without proper bounds checking, allowing an attacker to execute arbitrary commands on the client system.

Impact Analysis

If exploited, this vulnerability could let an attacker run malicious commands on your Db2 client system. This may lead to unauthorized data access, system compromise, or further network infiltration, depending on the attacker's goals and your system's configuration.

Mitigation Strategies

Apply the latest IBM Db2 patches or updates to versions beyond 11.5.9 or 12.1.5 to address the stack-based buffer overflow issue. Ensure DRDA server endpoints are properly authenticated and isolated to prevent impersonation attacks.

Hi! I’m here to help you understand CVE-2026-86093. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70