Attack Chain

1. An attacker gains low-privileged access to a system running a vulnerable version of IBM Db2 (11.5.0-11.5.9 or 12.1.0-12.1.4).
2. The attacker identifies the location of the setgid helper binary 'db2flacc', typically found in the Db2 installation bin directory.
3. The attacker crafts a malicious input string designed to exceed the allocated buffer space within the 'db2flacc' executable.
4. The attacker executes the 'db2flacc' binary, passing the malicious input string as an argument.
5. The application experiences a buffer overflow, allowing the attacker to overwrite the stack memory.
6. The attacker injects or redirects execution to malicious code within the process context.
7. The process executes with group-level privileges, effectively escalating the attacker's permissions to those of the Db2 group.
8. The attacker proceeds to modify database files or configuration parameters to achieve full system control or data exfiltration.

Impact

Successful exploitation of CVE-2026-10535 allows a local user to escalate privileges, potentially leading to full compromise of the database environment. This poses a high risk to organizations relying on IBM Db2 for sensitive data storage, as the impact includes potential data exfiltration, modification, or denial-of-service against the database engine.

Recommendation

Prioritized actions for security teams:

• Immediately identify all servers running affected IBM Db2 versions (11.5.0-11.5.9 and 12.1.0-12.1.4) using asset management tools.
• Apply the vendor-provided patch from IBM as described in the official advisory (https://www.ibm.com/support/pages/node/7279466).
• Review system access controls to limit the number of users capable of executing the 'db2flacc' binary.
• Monitor for unusual execution patterns or crashes of the 'db2flacc' binary using audit logs or endpoint detection and response (EDR) solutions.