A code injection vulnerability in IBM Db2 versions 11.5 and 12.1 enables authenticated local users to potentially execute arbitrary code on the database server.

The vulnerability is identified as CWE-94, which involves the improper control of code generation. It requires the attacker to have local access and low privileges to execute the injection successfully.

A successful code injection attack allows an authenticated local user to gain elevated control over the database environment. This could result in unauthorized data modification, exfiltration, or complete system takeover, justifying the high CVSS score of 7.8.

Immediate Action: Download and apply the appropriate interim fix or special build (e.g., Special Build #87098 or later for V11.5.9) from IBM Fix Central.

Proactive Monitoring: Audit database user permissions and monitor for unauthorized execution of administrative or system-level commands.

Compensating Controls: Enforce the principle of least privilege for all database users and ensure local system access is strictly controlled to prevent unauthorized login attempts.

Public Exploit Available: Unknown

While the exploit requires local access, the potential for code injection remains a significant security risk for database administrators. Administrators should apply the recommended interim fixes or special builds as soon as possible to mitigate this risk.