CVE-2026-13361: IBM Informix RCE Vulnerability

CVE-2026-13361 Overview

CVE-2026-13361 is a stack-based buffer overflow [CWE-121] in the IBM Informix database server. The flaw resides in the sq_sgkprepare function within the oninit process, which handles SQL Interface requests. An unchecked length field allows an authenticated attacker to overflow a stack buffer over the network. Successful exploitation results in remote code execution in the context of the database service.

Critical Impact
An authenticated attacker with low privileges can execute arbitrary code on the Informix server, compromising confidentiality, integrity, and availability of hosted databases.

Affected Products

IBM Informix Server (see the IBM Support Page for affected versions)
Deployments exposing the Informix SQL Interface listener to untrusted networks
Environments where low-privileged database accounts can reach the oninit service

Discovery Timeline

2026-08-12 - CVE-2026-13361 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-13361

Vulnerability Analysis

The vulnerability affects the sq_sgkprepare routine used to parse SQL Interface (SQLI) protocol messages inside the oninit server process. The routine reads a length field from the client-supplied packet and copies subsequent bytes into a fixed-size stack buffer. Because the length field is trusted without bounds checking, an attacker can supply a value larger than the destination buffer.

The out-of-bounds write corrupts adjacent stack memory, including saved return addresses and frame pointers. This memory corruption gives the attacker control over program flow. Because oninit typically runs with elevated privileges on the database host, code execution translates directly into full database and system compromise.

Root Cause

The root cause is missing input validation on a client-controlled length field prior to a memory copy operation. The condition is classified as CWE-121: Stack-based Buffer Overflow. The parser assumes the declared payload length matches the receiving buffer's capacity, and does not enforce an upper bound before writing.

Attack Vector

Exploitation requires network access to the Informix SQLI listener and valid low-privileged credentials. The attacker sends a crafted SQL Interface request whose length field triggers the overflow in sq_sgkprepare. No user interaction is required. See the IBM Support Page for vendor technical details.

Detection Methods for CVE-2026-13361

Indicators of Compromise

Unexpected crashes, restarts, or core dumps of the oninit process on Informix hosts.
Anomalous child processes spawned by oninit, such as shells or scripting interpreters.
Outbound network connections initiated by the Informix service to unfamiliar hosts.
Malformed SQLI protocol packets logged with oversized length fields to the database listener port.

Detection Strategies

Deploy endpoint monitoring on database hosts to flag process injection or shell spawning from oninit.
Inspect network traffic to the Informix SQLI listener for length fields exceeding expected message sizes.
Correlate authentication events with subsequent process anomalies to catch credentialed exploitation.

Monitoring Recommendations

Enable verbose logging on the Informix listener and forward logs to a centralized SIEM for retention and search.
Alert on repeated oninit restarts within short intervals, which can indicate exploitation attempts.
Track authentication activity for low-privileged Informix accounts connecting from unusual sources.

How to Mitigate CVE-2026-13361

Immediate Actions Required

Apply the IBM-provided patch referenced in the IBM Support Page as soon as feasible.
Restrict network access to the Informix SQLI listener using firewalls or security groups so only trusted application hosts can connect.
Audit and rotate credentials for all Informix database accounts, particularly low-privileged service accounts.

Patch Information

IBM has issued fixed versions and remediation guidance on the IBM Support Page. Administrators should review the advisory to identify the appropriate patch level for their Informix deployment and schedule installation according to change-management procedures.

Workarounds

Place the Informix server behind a bastion or jump host and deny direct network access from user subnets.
Enforce network segmentation between application tiers and the database tier to reduce reachable attack surface.
Disable or remove unused low-privileged database accounts to shrink the population of accounts that can reach the vulnerable code path.

bash

# Configuration example: restrict Informix listener to application subnet
iptables -A INPUT -p tcp --dport 9088 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9088 -j DROP