Cyber Resilience

CVE-2025-36384

Ibm Db2 12.1.0 – 12.1.3

Published
30 January 2026
Modified
05 February 2026
Patch / advisory
CVSS Score v3.1 8.4
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 6th percentile
Risk Priority 59 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2025-36384 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Ibm Db2. Its CVSS base score is 8.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2025-36384 is a privilege escalation vulnerability in IBM Db2 for Windows versions 12.1.0 through 12.1.3, stemming from the use of an unquoted search path element, classified under CWE-428. This flaw enables a local attacker with filesystem access to execute arbitrary code with elevated privileges when Db2 invokes certain binaries. The vulnerability carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its local attack vector, low complexity, and potential for complete system compromise.

A local user with filesystem access, requiring no special privileges (PR:N), can exploit this by placing a malicious executable in a directory that precedes legitimate paths in the system's search order. When Db2 launches the affected component, the attacker's binary executes instead, potentially granting high levels of confidentiality, integrity, and availability impact, such as full administrative control over the system.

IBM's security advisory at https://www.ibm.com/support/pages/node/7257678 provides details on mitigation, including recommended patches for affected Db2 versions. Security practitioners should apply these updates promptly and review systems for unquoted path configurations in Db2 installations.

EU & UK References

Vulnerability Data

IBM Db2 for Windows 12.1.0 - 12.1.3 could allow a local user with filesystem access to escalate their privileges due to the use of an unquoted search path element.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1034 Path Interception Persistence
**This technique has been deprecated.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-28762Same product: Ibm Db2
CVE-2023-29267Same product: Ibm Db2
CVE-2025-33012Same product: Ibm Db2
CVE-2025-14689Same product: Ibm Db2
CVE-2025-36098Same product: Ibm Db2
CVE-2025-36428Same product: Ibm Db2
CVE-2023-52296Same product: Ibm Db2
CVE-2025-36123Same product: Ibm Db2
CVE-2024-35152Same product: Ibm Db2
CVE-2025-36442Same product: Ibm Db2

Affected Assets

ibm
db2
12.1.0 — 12.1.3

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Developer testing and evaluation can discover unquoted search paths through static analysis or dynamic test cases.

Documented development standards and tools can mandate proper quoting and escaping of path elements.

Engineering principles can require safe construction and quoting of search paths and command elements.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent path-handling flaws such as unquoted elements during development.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing in development can detect unquoted search-path issues before deployment.

degrades

Enforcing controlled software installation can prevent unquoted search-path elements in executables and scripts.

prevents

Secure development lifecycle practices include input validation and path handling that reduce unquoted search-path weaknesses.

degrades

Secure system architecture and engineering principles require safe path construction and quoting conventions.

prevents

Secure coding standards directly mandate quoting search paths and avoiding unsafe path construction.

degrades

Change-management processes can enforce review of path-handling changes that might introduce unquoted elements.

References