CVE-2023-47145 is a high severity flaw in IBM Db2 for Windows, scored 8.4, that lets a local user escalate privileges to SYSTEM through the MSI repair feature. IBM provides special builds for 10.5, 11.1 and 11.5. Apply the one for your release and note that Linux and Unix are not affected.
What's affected
IBM's bulletin lists IBM Db2 10.5.0.x, 11.1.4.x and 11.5.x for Windows, including Db2 Connect Server, in the Client (RTCL) editions. IBM says Linux and Unix are not affected. Earlier releases such as 10.1 and 9.7 may also be affected but are no longer supported.
The fix comes as special builds with an interim fix, tracked as APAR DT256803. IBM lists them for V10.5 FP11, V11.1.4 FP7, V11.5.8 and V11.5.9, and they can be applied at any affected fix pack level of the release. The fix pack column reads TBD, so a permanent fix pack was not named at the time of the bulletin.
The record and IBM agree on 8.4. The bulletin credits Mandiant's James Curbow, and IBM states that it does not disclose Db2 functionality or steps to reproduce the issue.
The NVD record was published on 2024-01-07, scores 8.4 (High), and carries the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Weakness class: CWE-269.
How to check if you're exposed
Find Db2 installs on Windows and read the level.
db2level
Run it in a Db2 command window on each Windows host. It prints the product version and fix pack, which you compare with IBM's list. Then check that the host has the special build for your release by following the bulletin's instructions. For servers where several people can log in locally, treat the issue as more urgent.
What to do now
- List all Windows hosts running Db2, Db2 Connect Server or Db2 clients.
- Download the special build for your release, V10.5, V11.1.4 or V11.5, from Fix Central.
- Apply it in a maintenance window, then re-run db2level to record the result.
- Limit local and remote desktop logins on database hosts to administrators.
- Watch IBM's bulletin for the fix pack that includes the correction permanently.
Why it matters
This is an improper privilege management issue, CWE-269. Windows Installer repair runs with elevated rights. If a low-privileged user can influence what repair does, they can reach SYSTEM.
The exposure needs local access, so the typical path is a user who already has a foothold on the server. Even so, SYSTEM on a database host means access to data and credentials. The record's KEV flag is false, so this CVE is not on the CISA Known Exploited Vulnerabilities list.
Reducing who can log on to servers is as useful as the patch.
Quick check
Is Linux affected?
IBM says Linux and Unix are not affected. The flaw is specific to Windows and its MSI repair feature.
Sources
Last reviewed: 19 October 2026.
