Quick answers
- Is CVE-2026-18096 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-18096 being exploited in the wild.
- How severe is CVE-2026-18096?
- Low severity, with a CVSS score of 3.3, published 12 August 2026.
- Which products and versions are affected?
- IBM Db2 12.1.5.
- Is there a fix for CVE-2026-18096?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-18096 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-2026-18096?
- Check whether you run IBM Db2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability is a resource exhaustion flaw (CWE-770) in IBM Db2 12.1.5 for Linux, UNIX, and Windows (including DB2 Connect Server). A local attacker with low privileges can trigger a memory leak that gradually consumes available system memory without bounds, eventually causing denial of service. The attack requires local access to the system and no user interaction. IBM has released security updates through Fix Central; customers should apply Security Update #88454 or later for Db2 v12.1.5.
Affected products
- IBM Db2 12.1.5
Timeline
- 2026-08-07: disclosed
- 2026-08-12: advisory