CVE-2025-33092: IBM Db2 for Linux code execution

CVE-2025-33092 PUBLISHED CVSS 7.8 HIGH

IBM Db2 for Linux code execution

Reported by ibm · Published July 29, 2025

IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 is vulnerable to a stack-based buffer overflow in db2fm, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
Db2	IBM	12.1.2, 11.5.9

Risk scores

CVSS 3.1

7.8

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Vendor	Product	Versions
IBM	Db2	11.5.0, 12.1.0
IBM	Db2	11.5.0, 12.1.0

Timeline

Jul 29, 2025 Coalition ESS Score (8 in total, the first dated here)
Jul 29, 2025 CVE Published
Jul 30, 2025 EPSS Score (30 in total, the first dated here)
Feb 26, 2026 CVE Updated
Jun 2, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2025-33092
vulnetix vdb fixes CVE-2025-33092

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-33092/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

vendor-advisorypatch

Look up in the Resolve Platform →