Memory leak in IBM DB2 LUW - CVE-2025-1992

Vulnerability identifier: #VU113108

CSH Severity: Low

CVSS v4: 6 [CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-1992

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform DoS attack on the target system.

The vulnerability exists due to insufficient release of allocated memory after usage. A remote user can force the application to leak memory and perform denial of service attack.

IBM DB2 LUW
IBM Cloud Pak System
Db2 Big SQL
IBM OpenPages with Watson
Storage Protect Server
IBM Cloud Application Performance Management (APM)

Install updates from vendor's website.

Db2 Big SQL - update to 8.0
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.4
Storage Protect Server - update to 8.1.27.100

• https://www.ibm.com/support/pages/node/7232515

• Memory leak in IBM Db2 for Linux, UNIX and Windows
• Multiple vulnerabilities in IBM DB2 bundled with IBM Application Performance Management products
• Multiple vulnerabilities in IBM OpenPages
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM Storage Protect Server
• Multiple vulnerabilities in IBM Big SQL on IBM Cloud Pak for Data