CVE-2026-10534 is a high severity (CVSS 8.4) stack-based buffer overflow in the IBM Db2 IXF IMPORT parser, affecting 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on all platforms. IBM ships the fix as a security update for your release. Apply it, and be careful who can run imports.
What's affected
IBM's bulletin lists Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5, client and server, on all platforms.
Fixes come as security updates built on the most recent level of each release: V11.5.9, V12.1.4 and V12.1.5. The bulletin lists security update 87984 or later for V11.5.9, 86025 or later for V12.1.4 and 88454 or later for V12.1.5, under APAR DT471716. The fixed-in mod pack is shown as to be determined, so go by the security update numbers.
How to check if you're exposed
Check the Db2 level on every instance and client:
db2level
Compare the result with the range in the bulletin: 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5. Note the fix pack and any interim fix already applied, and list every server and client install, including those on build servers and in containers.
What to do now
- Apply the IBM security update for your release from Fix Central, using the links in the IBM bulletin.
- Update the client installs as well as the servers, since the bulletin lists both.
- Limit who can run IXF imports on your instances to people who need to, and avoid importing files from sources you do not trust.
- IBM lists no workarounds, so plan the update rather than a mitigation.
- Subscribe to IBM notifications to hear about later bulletins.
Why it matters
IXF is a file format Db2 uses to exchange table data, and the IMPORT command parses it. A parser that trusts lengths in a file can write past a fixed buffer. The record classes this as CWE-121 (stack-based buffer overflow).
The vector is local (AV:L): the attacker needs to run the import on the machine. That narrows the risk, but a local attack vector still matters on shared database hosts, in automation that imports files and where an unprivileged user can reach Db2 tools.
IBM does not publish more detail, by policy, to avoid helping an attacker. The record does not report exploitation in the wild, and the KEV flag is false.
Quick check
Why is the vector local, if this is a database?
IBM scored it AV:L, meaning the attacker runs the import on the machine. Treat any process that can load files into Db2 as part of your attack surface.
Sources
Last reviewed: 19 October 2026.
