CVE-2025-36384: IBM Db2 Privilege Escalation Vulnerability

CVE-2025-36384 Overview

CVE-2025-36384 affects IBM Db2 for Windows versions 12.1.0 through 12.1.3. The vulnerability allows a local user with filesystem access to escalate privileges due to an unquoted search path element [CWE-428]. When Windows encounters a service path containing spaces without proper quoting, it attempts to execute binaries at each space-delimited segment. An attacker who can write to a higher-priority path segment can place a malicious executable that runs with the elevated privileges of the Db2 service.

Critical Impact
A local authenticated user can achieve code execution in the security context of the Db2 service, typically SYSTEM, resulting in full compromise of confidentiality, integrity, and availability on the affected Windows host.

Affected Products

IBM Db2 for Windows 12.1.0
IBM Db2 for Windows 12.1.1 through 12.1.2
IBM Db2 for Windows 12.1.3

Discovery Timeline

2026-01-30 - CVE-2025-36384 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36384

Vulnerability Analysis

The vulnerability originates from an unquoted service path in the IBM Db2 installation on Windows. Windows services register an ImagePath value in the registry that points to the service executable. When this path contains spaces and is not wrapped in quotes, the Windows Service Control Manager parses the string incrementally. It attempts to launch each candidate binary from left to right until it finds a match.

An attacker with write permissions to an intermediate directory in the path can plant an executable that Windows will load in preference to the intended Db2 binary. Because Db2 services generally run as LocalSystem, the planted binary inherits SYSTEM privileges when the service starts or restarts. Exploitation requires local access and low privileges but no user interaction.

EPSS currently rates the probability of exploitation activity at a low percentile, but the technique is well documented and trivial to weaponize once a writable path segment is identified.

Root Cause

The root cause is improper quoting of the service executable path during installation, categorized as CWE-428 (Unquoted Search Path or Element). If the Db2 service binary is installed under a path such as C:\Program Files\IBM\SQLLIB\BIN\db2syscs.exe and registered without surrounding quotes, Windows will first attempt C:\Program.exe, then C:\Program Files\IBM\SQLLIB\BIN\db2syscs.exe, and so on.

Attack Vector

An authenticated local attacker enumerates Windows services and identifies the Db2 service registered with an unquoted ImagePath containing spaces. The attacker checks directory access control lists along the path for a writable segment. Common misconfigurations grant Authenticated Users write access to C:\ or third-party directories. The attacker plants a malicious executable named to match a truncated path segment, such as Program.exe. When the Db2 service restarts, on system reboot, or by administrative action, Windows loads the attacker binary as SYSTEM.

No verified proof-of-concept code is published in the referenced sources. Refer to the IBM Support Page for vendor guidance.

Detection Methods for CVE-2025-36384

Indicators of Compromise

Unexpected executable files at root-level paths such as C:\Program.exe or intermediate directories that match Db2 service path segments.
New or modified service binaries in directories that are not part of the official IBM Db2 installation.
Child processes of services.exe that resolve to unexpected file paths outside C:\Program Files\IBM\SQLLIB\.

Detection Strategies

Audit all Windows services on Db2 hosts and flag any ImagePath value containing spaces without surrounding quotation marks.
Monitor filesystem write events to root drives and intermediate program directories using endpoint telemetry.
Correlate Windows Service Control Manager events (Event ID 7045, 7036) with unusual binary paths at service start.

Monitoring Recommendations

Enable Sysmon Event ID 1 (process creation) and alert when services.exe spawns processes from non-standard paths.
Track registry modifications to HKLM\SYSTEM\CurrentControlSet\Services\*\ImagePath for Db2-related services.
Baseline expected Db2 service binaries and alert on deviation, including new files planted under C:\ or C:\Program Files\.

How to Mitigate CVE-2025-36384

Immediate Actions Required

Apply the IBM-provided fix referenced in the vendor advisory to all Db2 for Windows installations in the 12.1.0 through 12.1.3 range.
Inventory Db2 hosts and inspect service registry entries for unquoted ImagePath values, correcting them by wrapping the executable path in quotes.
Restrict write permissions on C:\ and intermediate directories so that non-administrative users cannot plant executables along service search paths.

Patch Information

IBM has published remediation guidance on the IBM Support Page for CVE-2025-36384. Administrators should follow the vendor-supplied instructions to update affected Db2 for Windows deployments and validate that service paths are properly quoted after patching.

Workarounds

Manually edit the affected service ImagePath registry values to enclose the full executable path in double quotes, then restart the service during a maintenance window.
Remove write and modify permissions from Authenticated Users and Users groups on any directory that appears as an intermediate segment in the Db2 service path.
Restrict local logon rights on database servers to reduce the population of users who could stage an unquoted path exploit.

bash

# Configuration example: verify and quote a Windows service ImagePath (PowerShell)
$svc = Get-CimInstance Win32_Service -Filter "Name='DB2'"
$svc.PathName
# If output lacks surrounding quotes and contains spaces, correct it:
sc.exe config DB2 binPath= "\"C:\Program Files\IBM\SQLLIB\BIN\db2syscs.exe\""