CVE-2026-6052
📛 CVE Title
IBM® Db2® is vulnerable to running out of memory when executing certain queries with MDC tables
Description
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to running out of memory when executing certain queries with MDC tables.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- ibm
- CVSS severity
- MEDIUM
- CVSS score
- 6.5 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H- Effective score
- 6.5 / 10 MEDIUM source: CNA overview
- CWE(s)
- —
- Reserved
- 2026-04-09
- Published
- 2026-05-27 13:09 UTC
- Last updated
- 2026-05-27 15:22 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6052.json
- Linked Threat
- CVE-2026-6052 — CVE-2026-6052
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-05-27 14:17:34 UTC
- NVD last modified
- 2026-06-17 11:00:14 UTC
- NVD CVSS v3.1
- 6.5 / 10 MEDIUM source: psirt@us.ibm.com
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H- Exploitability subscore
- 2.8 / 10
- Impact subscore
- 3.6 / 10
- EPSS score
- 0.0024 (probability of exploitation in next 30 days)
- EPSS percentile
- 15.57% vs all CVEs — higher = more likely to be exploited, as of 2026-08-01
NVD-assigned CWE(s):
CWE-400
(differs from the CNA list above)
NVD / KEV / EPSS data refreshed 2026-08-01 17:07 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-32489 - Assigner
- ibm
- Published
- May 27, 2026, 1:09:29 PM
- Updated
- May 27, 2026, 3:22:19 PM
- EUVD base score (CVSS 3.1)
-
6.5 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - EUVD-reported EPSS
- 0.2400
- Vendors
- IBM
- Products
-
DB2 (11.5.0 ≤11.5.9)DB2 (12.1.0 ≤12.1.4)
- Aliases
-
GHSA-gpjv-6r8h-vp58
ENISA description: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to running out of memory when executing certain queries with MDC tables.
EUVD references (1)
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| IBM | Db2 |
11.5.0 (affected),
12.1.0 (affected)
|
— |
Affected products — CPE 2.3 (5) NVD
NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.
cpe:2.3:a:ibm:db2:*:*:*:*:-:*:*:*cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*cpe:2.3:o:ibm:linux_on_ibm_z:-:*:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
- https://www.ibm.com/support/pages/node/7273557 vendor-advisorypatch
Web references (4)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://nvd.nist.gov/vuln/detail/CVE-2026-6052 tenable:nvd.nist.gov
- https://www.cve.org/CVERecord?id=CVE-2026-6052 tenable:www.cve.org
- https://www.first.org/epss/ tenable:www.first.org
- https://www.ibm.com/support/pages/node/7273557 tenable:www.ibm.com
NVD-tagged references (1)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://www.ibm.com/support/pages/node/7273557 psirt@us.ibm.com Vendor Advisory
Remediations (17)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:blog.qualys.com
May 2026's Patch Tuesday arrives with Microsoft addressing a fresh set of vulnerabilities across its ecosystem, reinforcing the ongoing need for timely patching in an increasingly threat-heavy…
2026-06-04 00:08 UTC -
web:cybersecuritynews.com
Microsoft's May 2026 Patch Tuesday lands with a heavy enterprise focus, fixing 120 vulnerabilities across Windows, Office, Azure, developer tools, and Microsoft 365 apps, including 29 remote code execution (RCE) flaws rated Critical.
2026-06-04 00:08 UTC -
web:hivepro.com
Microsoft Patch Tuesday Overview and Vulnerability Distribution Microsoft's May 2026 Patch Tuesday delivers a comprehensive security update addressing 137 Microsoft vulnerabilities across the product ecosystem.
2026-06-04 00:08 UTC -
web:nvd.nist.gov
An official website of the United States government NVD MENU
2026-06-04 00:08 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-06-04 00:08 UTC -
web:thecyberexpress.com
Microsoft has rolled out its May 2026 Patch Tuesday security updates, delivering fixes for approximately 120 vulnerabilities across Windows, Microsoft Office, networking services, and enterprise platforms.
2026-06-04 00:08 UTC -
web:www.cisecurity.org
<p>Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or ...
2026-06-04 00:08 UTC -
web:www.ntcompatible.com
The May 2026 Security Update delivers 265 patches, with the bulk of the work focusing on Chromium browser hardening and critical Windows kernel fixes. High severity flaws in the TCP/IP stack and Win32k graphics subsystem are addressed to block privilege escalation and remote code execution attempts.
2026-06-04 00:08 UTC -
web:www.techrepublic.com
Microsoft's May Patch Tuesday fixes 120 flaws, including 31 remote code execution bugs, with no zero-days reported at release.
2026-06-04 00:08 UTC -
web:zecurit.com
Get the complete breakdown of Microsoft's June 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .
2026-06-04 00:08 UTC -
web:cybersecuritynews.com
Microsoft has officially acknowledged a critical zero-day vulnerability in Microsoft Defender, publicly dubbed "RoguePlanet," and confirmed it is actively developing a security patch to address the flaw.
2026-06-19 02:28 UTC -
web:learn.microsoft.com
In this library you will find the following security documents that have been released by the Microsoft Security Response Center (MSRC). The MSRC investigates all reports of security vulnerabilities affecting Microsoft products and services, and releases these documents as part of the ongoing effort to help you manage security risks and help keep your systems protected. Please use the ...
2026-06-19 02:28 UTC -
web:nvd.nist.gov
An official website of the United States government Here's how you know
2026-06-19 02:28 UTC -
web:thehackernews.com
Microsoft patches 59 vulnerabilities, including six actively exploited zero-days, with CISA mandating urgent federal remediation .
2026-06-19 02:28 UTC -
web:www.bleepingcomputer.com
Today is Microsoft's February 2026 Patch Tuesday with security updates for 58 flaws, including 6 actively exploited and three publicly disclosed zero-day vulnerabilities.
2026-06-19 02:28 UTC -
web:www.csoonline.com
Microsoft highlighted six new and actively exploited vulnerabilities among the 60 fixes issued in today's February Patch Tuesday releases.
2026-06-19 02:28 UTC -
web:www.malwarebytes.com
Microsoft says it's working on a fix for an unpatched Defender vulnerability that can give attackers the highest level of access on Windows.
2026-06-19 02:28 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-6052.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6052",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-27T15:21:52.352065Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T15:22:19.791Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:db2:12.1.4:*:*:*:*:*:*:*"
],
"product": "Db2",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "11.5.9",
"status": "affected",
"version": "11.5.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "12.1.4",
"status": "affected",
"version": "12.1.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to running out of memory when executing certain queries with MDC tables.</p>"
}
],
"value": "IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to running out of memory when executing certain queries with MDC tables."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T13:09:29.770Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7273557"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>Customers running any vulnerable affected level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, and V12.1.4. They can be applied to any affected level of the appropriate release to remediate this vulnerability.</p><p></p><div><table><tbody><tr><td><strong>Release</strong></td><td><strong>Fixed in mod pack</strong></td><td><strong>APAR</strong></td><td><strong>Download URL</strong></td></tr><tr><td>V11.5</td><td>TBD</td><td><a href=\"https://www.ibm.com/mysupport/s/defect/aCIgJ000000BcEr/dt465726\" rel=\"nofollow\">DT465726</a></td><td><p>Special Build #81937 or later for V11.5.9 available at this link:<br><a href=\"https://www.ibm.com/support/pages/node/7087189\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/support/pages/node/7087189</a></p></td></tr><tr><td><p>V12.1</p><p></p></td><td><p>TBD</p><p></p></td><td><p><a href=\"https://www.ibm.com/mysupport/s/defect/aCIgJ000000BcEr/dt465726\" rel=\"nofollow\">DT465726</a></p><p></p></td><td><p>Special Build #83501 or later for V12.1.4 available at this link:<br><a href=\"https://www.ibm.com/support/pages/node/7267513\" rel=\"nofollow\">https://www.ibm.com/support/pages/node/7267513</a></p></td></tr></tbody></table></div><p></p><p>IBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.</p>"
}
],
"value": "Customers running any vulnerable affected level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, and V12.1.4. They can be applied to any affected level of the appropriate release to remediate this vulnerability.\n\n\n\n\n\nReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 \n\n\n\nV12.1\n\n\n\n\n\n\n\nTBD\n\n\n\n\n\n\n\n https://www.ibm.com/support/pages/node/7267513 \n\n\n\n\n\n\n\n\n\nIBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability."
}
],
"title": "IBM\u00ae Db2\u00ae is vulnerable to running out of memory when executing certain queries with MDC tables",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>Do not use Multi-Clustering-Dimensional (MDC) tables</p>"
}
],
"value": "Do not use Multi-Clustering-Dimensional (MDC) tables"
}
],
"x_generator": {
"engine": "ibm-cvegen"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-6052",
"datePublished": "2026-05-27T13:09:29.770Z",
"dateReserved": "2026-04-09T22:08:53.174Z",
"dateUpdated": "2026-05-27T15:22:19.791Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}