PT-2026-20248 · Ibm · Ibm Db2

Published 2026-02-17 · Updated 2026-02-22 · CVE-2025-36247

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions IBM Db2 versions 11.5.0 through 11.5.9 IBM Db2 versions 12.1.0 through 12.1.3

Description The software is susceptible to an XML external entity (XXE) injection when handling XML data. A remote attacker may be able to leverage this issue to reveal sensitive information or exhaust memory resources.

Recommendations Update IBM Db2 to a version later than 11.5.9 Update IBM Db2 to a version later than 12.1.3

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2025-36247

Affected Products

Ibm Db2

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-36247 · Security Note
• https://osv.dev/vulnerability/CVE-2025-36247 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2023892817953599893 · Twitter Post
• https://twitter.com/RedPacketSec/status/2023851148566781957 · Twitter Post
• https://ibm.com/support/pages/node/7259961 · Patch, Vendor Advisory
• https://twitter.com/cracbot/status/2025526050231583005 · Twitter Post