IBM DB2 HPU Crash via Bad Size Calc (auth) pre-6.5.0.0 IF1
CVE-2025-33132 Published on October 27, 2025
Fixes to common vulnerabilities found in IBM Db2 High Performance Unload
IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to crash due to the incorrect calculation of the size of the data that is being pointed to.
Vulnerability Analysis
CVE-2025-33132 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
Use of sizeof() on a Pointer Type
The code calls sizeof() on a malloced pointer type, which always returns the wordsize/8. This can produce an unexpected result if the programmer intended to determine how much memory has been allocated. The use of sizeof() on a pointer can sometimes generate useful information. An obvious case is to find out the wordsize on a platform. More often than not, the appearance of sizeof(pointer) indicates a bug.
Products Associated with CVE-2025-33132
stack.watch emails you whenever new vulnerabilities are published in IBM Db2 High Performance Unload or IBM Db2. Just hit a watch button to start following.
Affected Versions
IBM DB2 High Performance Unload:- Version 6.1.0.3 is affected.
- Version 5.1.0.1 is affected.
- Version 6.1.0.2 is affected.
- Version 6.5 is affected.
- Version 6.5.0.0 IF1 is affected.
- Version 6.1.0.1 is affected.
- Version 6.1 is affected.
- Version 5.1 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.