Stack-based buffer overflow in Db2 for Linux - CVE-2025-33092

Vulnerability identifier: #VU114124

CSH Severity: Medium

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-33092

CWE-ID: CWE-121

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due to improper bounds checking. A local user can send a specially crafted query to overflow the buffer and execute arbitrary code on the system.

Db2 for Linux
Watson Query on Cloud Pak for Data
Data Virtualization (DV) on Cloud Pak for Data (CPD)
Db2 Big SQL
IBM OpenPages with Watson
IBM Cloud Pak System
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Tivoli Business Service Manager
IBM Security Verify Governance

Install updates from vendor's website.

IBM Cloud Pak System - update to 2.3.6.1
Data Virtualization (DV) on Cloud Pak for Data (CPD) - update to 3.2.1
Db2 Big SQL - update to 8.1
IBM OpenPages with Watson - update to 9.1.2

• https://www.ibm.com/support/pages/node/7240940

• Stack-based buffer overflow in IBM Db2 for Linux
• Multiple vulnerabilities in IBM Security Guardium Key Lifecycle Manager
• Multiple vulnerabilities in IBM Data Virtualization on IBM Software Hub
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in IBM OpenPages
• Multiple vulnerabilities in IBM Tivoli Business Service Manager
• Multiple vulnerabilities in IBM Big SQL on IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak System