Vulnerability details
CVE-2025-36247
IBM DB2 for Linux
IBM Db2 XML External Entity Reference
CVSS 3.1
7.1High
Official description
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.1High | 3.1 | CVEProject cvelistV5 (CNA) (ibm) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| IBM | DB2 for Linux, UNIX and Windows | 11.5.0 ≤ v ≤ 11.5.9 | CVEProject cvelistV5 (CNA) |
| IBM | DB2 for Linux, UNIX and Windows | 12.1.0 ≤ v ≤ 12.1.3 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://www.ibm.com/support/pages/node/7259961 patchvendor-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-02-17
- Last updated
- 2026-02-17
- State
- Published
- Assigner (CNA)
- ibm
Exploit prediction (EPSS)
0.34%
Probability of exploitation in 30 days
28.3%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-611Improper Restriction of XML External Entity Reference