CVE-2026-10535: 
IBM Db2 vulnerability analysis and mitigation

CVE-2026-10535 is a stack-based buffer overflow vulnerability in IBM Db2's setgid helper binary db2flacc. It affects IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4. IBM published the initial security bulletin on July 10, 2026, with NVD publication on July 30, 2026. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) per NVD, and 8.4 (High) per IBM/ENISA scoring (IBM Advisory, GitHub Advisory).

The vulnerability is classified as CWE-121 (Stack-based Buffer Overflow), rooted in insufficient bounds checking within the db2flacc helper binary, which runs with elevated setgid privileges on Linux systems. A local attacker with low privileges can supply crafted input to overflow a stack buffer in this helper, potentially overwriting return addresses or control data to redirect execution flow. Because db2flacc is a setgid binary, successful exploitation can result in privilege escalation beyond the attacker's current user context. No public proof-of-concept code has been identified at this time (IBM Advisory, GitHub Advisory).

Successful exploitation of this vulnerability allows a local attacker to achieve high impact across confidentiality, integrity, and availability — consistent with full compromise of the affected Db2 instance. By exploiting the setgid db2flacc binary, an attacker could escalate privileges to the group owning the binary, potentially gaining unauthorized access to Db2 data files, modifying database contents, or disrupting database availability. This vulnerability also affects IBM Application Performance Management products that bundle IBM Db2 (IBM APM Advisory).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-10535. The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as not automatable, reflecting its local-only attack vector requiring an authenticated user. The EPSS score is approximately 0.12%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (IBM Advisory, GitHub Advisory).

IBM has released patches addressing this vulnerability. Users should upgrade IBM Db2 version 11.5.x to a fixed release beyond 11.5.9 (apply the relevant fix pack as directed by IBM), and upgrade IBM Db2 12.1.x to version 12.1.5 or later. Organizations using IBM Application Performance Management products that bundle Db2 should also apply the relevant APM security update. IBM recommends contacting IBM Support for specific fix pack guidance (IBM Advisory, IBM APM Advisory).

Coverage of CVE-2026-10535 has been limited to standard vulnerability aggregator sites and IBM's own security bulletins, with no notable independent researcher commentary or significant social media discussion identified. The vulnerability was noted on VulDB and referenced briefly on Mastodon/infosec.exchange by automated vulnerability tracking accounts (IBM Advisory).