CVE-2025-36384: 
IBM Db2 vulnerability analysis and mitigation

CVE-2025-36384 is an unquoted search path vulnerability in IBM Db2 for Windows that allows a local user with filesystem access to escalate their privileges. It affects IBM Db2 versions 12.1.0 through 12.1.3 running on Windows. The vulnerability was published on January 30, 2026, with a patch made available shortly after. It carries a CVSS v3.1 base score of 7.8 (High) per NVD, and 8.4 (High) per ENISA's scoring (IBM Support, Red Hat CVE).

The root cause is classified as CWE-428 (Unquoted Search Path or Element), a well-known Windows-specific weakness where executable paths containing spaces are not enclosed in quotation marks. On Windows, if a service or process is launched using an unquoted path such as C:\Program Files\IBM\Db2\bin\db2service.exe, the OS may attempt to execute intermediate path components (e.g., C:\Program.exe) before reaching the intended binary. A local attacker with write access to a parent directory in the path can place a malicious executable at one of these intermediate locations, which will then be executed with the privileges of the Db2 service — typically SYSTEM or a high-privileged account. No user interaction is required and attack complexity is low, provided the attacker has local filesystem access (IBM Support, Red Hat CVE).

Successful exploitation allows a local attacker to execute arbitrary code with elevated privileges, potentially achieving complete system compromise. This includes unauthorized access to the Db2 database and its contents, data theft, data manipulation, and service disruption. Because the vulnerability can result in code execution at the privilege level of the Db2 service (often SYSTEM), an attacker could use this as a stepping stone for lateral movement within the environment (IBM Support).

1. Reconnaissance: Enumerate IBM Db2 services on the target Windows system using sc qc <service_name> or wmic service get name,pathname,startmode to identify services with unquoted paths containing spaces.
2. Identify vulnerable path: Confirm that the Db2 service binary path is unquoted and contains spaces (e.g., C:\Program Files\IBM\SQLLIB\...\db2syscs.exe).
3. Check write permissions: Use icacls or accesschk.exe to verify that the local user has write access to a parent directory in the unquoted path (e.g., C:\Program Files\IBM\ or C:\Program.exe location).
4. Place malicious executable: Drop a crafted executable (e.g., a reverse shell or privilege escalation payload) at the exploitable intermediate path location (e.g., C:\Program.exe or C:\Program Files\IBM.exe).
5. Trigger execution: Wait for or trigger a restart of the vulnerable Db2 service (e.g., via system reboot or service restart if permitted). Windows will attempt to execute the malicious binary before reaching the legitimate Db2 executable.
6. Achieve elevated code execution: The malicious payload executes with the privileges of the Db2 service account, granting the attacker elevated or SYSTEM-level access (IBM Support).

• Logs: Windows System Event Log entries (Event ID 7045 or 7036) showing unexpected service start/stop activity for Db2-related services; Security Event Log entries (Event ID 4688) showing unusual process creation from service host processes.
• File System: Unexpected executables placed in root or intermediate directories of the Db2 installation path (e.g., C:\Program.exe, C:\Program Files\IBM.exe); modification timestamps on directories in the Db2 install path that do not align with known maintenance windows.
• Process: Unusual child processes spawned by Db2 service processes (e.g., cmd.exe, powershell.exe, net.exe) with elevated privileges; processes running as SYSTEM that are not part of the standard Db2 process tree.
• Network: Unexpected outbound network connections originating from Db2 service processes to external or unusual internal IP addresses.

IBM has released a patch addressing this vulnerability; affected organizations should apply the fix referenced in IBM Support page node 7257678 for IBM Db2 versions 12.1.0 through 12.1.3 on Windows (IBM Support). As an interim workaround, administrators should restrict local filesystem write access to Db2 installation directories to trusted users and service accounts only, following the principle of least privilege. Additionally, organizations should audit all Db2-related Windows services for unquoted paths using tools like wmic service get name,pathname and monitor for unauthorized file creation in Db2 installation directories.

Heise (a German technology news outlet) covered the vulnerability, noting that root-level attacks on IBM Db2 were possible via this flaw (Heise). VulDB and infosec.exchange accounts also noted the vulnerability shortly after disclosure. Overall community reaction has been measured, consistent with the low EPSS score and absence of public exploit code.