# CVE-2026-104332: IBM Db2 denial of service in Materialized Query Table

Source: https://junglewise.ai/threats/cve-2026-104332-ibm-db2-11-5-0-through-11-5-9-and-12-1-0-through-12-1-5-is  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-104332 · Severity: medium · CVSS 5.5 · Published 2026-10-12

IBM Db2, a widely deployed enterprise database system, contains a flaw that allows authenticated local users to crash the database service by submitting specially crafted queries involving Materialized Query Tables. This results in service unavailability and potential data access disruption for dependent applications.

Technologies: [IBM Db2](https://junglewise.ai/threats/technologies/db2). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-104332 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104332 being exploited in the wild.

**How severe is CVE-2026-104332?** Medium severity, with a CVSS score of 5.5, published 12 October 2026.

**Which products and versions are affected?** IBM Db2 11.5.0 through 11.5.9, 12.1.0 through 12.1.5.

**Is there a fix for CVE-2026-104332?** Yes: fixed in Db2 11.5.9 with Security Update #94236 or later; Db2 12.1.4 with Security Update #94722 or later; Db2 12.1.5 with Security Update #94858 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104332 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-104332?** Check whether you run IBM Db2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Db2 11.5.9 with Security Update #94236 or later; Db2 12.1.4 with Security Update #94722 or later; Db2 12.1.5 with Security Update #94858 or later

## Technical details

A stack-based buffer overflow in Db2's Materialized Query Table processing allows an authenticated attacker with local access to trigger a denial of service. The vulnerability requires local system access and database user privileges to execute the malicious query; no network-based exploitation is possible. A fix is available via security updates for supported versions.

## Affected products

- IBM Db2 11.5.0 through 11.5.9, 12.1.0 through 12.1.5

## Timeline

- 2026-10-08: disclosed

## References

- [https://www.ibm.com/support/pages/node/7291614](https://www.ibm.com/support/pages/node/7291614)

## Related threats

- [IBM Db2 denial of service in Materialized Query Table query processing](https://junglewise.ai/threats/cve-2026-113698-ibm-db2-11-5-0-through-11-5-9-and-12-1-0-through-12-1-5-is)
- [IBM Db2 local privilege escalation in db2pd utility](https://junglewise.ai/threats/cve-2026-78404-ibm-db2-11-5-0-through-11-5-9-and-12-1-0-through-12-1-5-is)
- [IBM Db2 arbitrary library loading via CREATE WRAPPER](https://junglewise.ai/threats/cve-2026-18166-ibm-db2-11-5-0-through-11-5-9-and-12-1-0-through-12-1-5-for-linux)
- [IBM Db2 denial of service in XML column insertion](https://junglewise.ai/threats/cve-2026-105466-ibm-db2-11-5-0-through-11-5-9-and-12-1-0-through-12-1-5-is)
- [IBM Db2 privilege escalation with db2locssh enabled](https://junglewise.ai/threats/cve-2026-105465-ibm-db2-11-5-0-through-11-5-9-and-12-1-0-through-12-1-5-is)