Cyber Resilience

CVE-2025-36423

Ibm Db2 12.1.0 – 12.1.3

Published
30 January 2026
Modified
05 February 2026
Patch / advisory
View advisory
CVSS Score v3.1 6.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0024 16th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-36423 is a medium-severity Improper Validation of Specified Quantity in Input (CWE-1284) vulnerability in Ibm Db2. Its CVSS base score is 6.5 (Medium).

Operationally, ranked at the 16th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic.

CWE(s)
CWE-1284

Related Threats

CVEs Like This One

CVE-2026-1352Same product: Ibm Db2
CVE-2025-13867Same product: Ibm Db2
CVE-2025-36428Same product: Ibm Db2
CVE-2025-36009Same product: Ibm Db2
CVE-2025-36427Same product: Ibm Db2
CVE-2025-14689Same product: Ibm Db2
CVE-2025-36424Same product: Ibm Db2
CVE-2025-14688Same product: Ibm Db2
CVE-2025-36407Same product: Ibm Db2
CVE-2026-1577Same product: Ibm Db2

Affected Assets

ibm
db2
12.1.0 — 12.1.3 · 12.1.0 — 12.1.3 · 12.1.0 — 12.1.3

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SC-5 Denial-of-service Protection
  • AC-6 Least Privilege
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V6.7.2
  • V1.4.2
  • V2.1.1
  • V2.2.1

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation and neutralization of special elements in inputs such as queries, blocking the exact flaw (improper neutralization leading to DoS) exploited by the local user.

SC-5 Denial-of-service Protection good match
prevent

Mandates controls that protect against or limit denial-of-service effects caused by crafted query inputs against Db2.

AC-6 Least Privilege partial match
prevent

Restricts local user privileges so that even a successful query-logic DoS attempt has reduced impact on the Db2 instance.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require proper quantity/length validation in input handling.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing in development can detect missing quantity validation but does not itself implement the control.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle mandates input validation for quantity fields, directly preventing CWE-1284.

A.8.26 Application security requirements partial match
prevents

Application security requirements explicitly call for validation of size/length inputs, mitigating CWE-1284.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles encourage robust input handling but do not specifically address quantity validation.

A.8.28 Secure coding partial match
prevents

Secure coding standards require explicit checks on numeric quantity inputs, fully addressing CWE-1284.

References