CVE-2026-104332: IBM Db2 DOS Vulnerability

CVE-2026-104332 Overview

CVE-2026-104332 is a denial of service vulnerability affecting IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5. An authenticated local attacker can trigger the flaw by executing a specially crafted query that references a Materialized Query Table (MQT). The underlying weakness is classified as a stack-based buffer overflow [CWE-121] within the Db2 query processing path. Successful exploitation causes service disruption but does not affect confidentiality or integrity of stored data.

Critical Impact
Authenticated local users can crash the Db2 database engine by issuing a crafted query against a Materialized Query Table, disrupting availability for all connected applications.

Affected Products

IBM Db2 11.5.0 through 11.5.9
IBM Db2 12.1.0 through 12.1.5
Deployments using Materialized Query Tables (MQTs)

Discovery Timeline

2026-10-12 - CVE-2026-104332 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-104332

Vulnerability Analysis

The vulnerability resides in the Db2 query execution logic that handles Materialized Query Tables. When Db2 processes a specially crafted query referencing an MQT, a stack-based buffer overflow condition occurs in the query processor. The overflow corrupts stack memory associated with the database engine process. The result is an abnormal termination of the Db2 instance, denying service to all applications depending on the database.

The scope impact is limited to availability. Attackers cannot read sensitive data or alter stored records through this flaw. However, in environments where Db2 supports transactional workloads, a crash can cascade into application outages and transaction rollbacks.

Root Cause

The root cause is a stack-based buffer overflow [CWE-121] in the Db2 code path that parses and executes queries involving Materialized Query Tables. Input bounds are not validated against the fixed-size stack buffer used during MQT query processing. Crafted query structures cause the buffer boundary to be exceeded.

Attack Vector

Exploitation requires local access and low-privilege authentication to the Db2 instance. The attacker must be able to submit SQL queries that reference or interact with a Materialized Query Table. No user interaction is required. Because the attack vector is local and privileges are required, remote unauthenticated exploitation is not feasible.

No public proof-of-concept exploit is available at this time. See the IBM Support Article for vendor-specific technical details.

Detection Methods for CVE-2026-104332

Indicators of Compromise

Unexpected Db2 instance crashes or db2sysc process terminations following query execution
Stack trace entries in Db2 diagnostic logs (db2diag.log) referencing MQT query processing
First Occurrence Data Capture (FODC) directories generated during abnormal termination
Repeated connection failures from application tiers correlating with database restarts

Detection Strategies

Monitor Db2 audit logs for anomalous query patterns targeting Materialized Query Tables, particularly from low-privilege accounts
Correlate database crash events with the authenticated user session that submitted the triggering query
Baseline normal MQT query structures and alert on syntactically unusual variants submitted by non-administrative users

Monitoring Recommendations

Enable Db2 audit facility (db2audit) to capture EXECUTE events against MQT objects
Forward db2diag.log and FODC artifacts to a centralized logging platform for retention and analysis
Alert on repeated db2sysc restarts within short time windows, which may indicate iterative exploitation attempts

How to Mitigate CVE-2026-104332

Immediate Actions Required

Apply the IBM Db2 security update referenced in the IBM Support Article as soon as change windows allow
Audit database privileges and remove unnecessary query execution rights from accounts that do not require MQT access
Review existing MQT definitions and restrict usage to roles with a documented business need

Patch Information

IBM has published guidance for affected Db2 versions in the IBM Support Article. Administrators running Db2 11.5.0 through 11.5.9 or 12.1.0 through 12.1.5 should upgrade to the fixed release identified by IBM. Validate the patch in a staging environment before production rollout, and schedule a full instance restart as required by the fix pack installation.

Workarounds

Restrict database connection access to trusted administrative networks until the patch is deployed
Revoke SELECT and REFERENCES privileges on Materialized Query Tables from non-essential users and roles
Enforce least-privilege authentication and remove shared or default low-privilege accounts that could be abused locally

bash

# Revoke MQT privileges from a role as a temporary mitigation
db2 "REVOKE SELECT ON TABLE schema.mqt_name FROM ROLE untrusted_role"
db2 "REVOKE REFERENCES ON TABLE schema.mqt_name FROM ROLE untrusted_role"

# Enable auditing for EXECUTE events on the Db2 instance
db2audit configure scope execute status both error type normal
db2audit start