IBM Db2 versions 11.5.0 to 11.5.9 and 12.1.0 to 12.1.4 for Linux, UNIX, and Windows, including DB2 Connect Server, improperly store potentially sensitive information in log files. This could allow a local user with access to the system to read sensitive data from these logs. The vulnerability is classified under CWE-532, which relates to the insertion of sensitive information into log files. The CVSS v3.1 base score is 5.5, indicating medium severity, with attack vector local, low attack complexity, low privileges required, no user interaction, and impact limited to confidentiality. No official fix or patch has been confirmed as of the published date.

The vulnerability allows local users to access sensitive information stored in log files by IBM Db2, potentially leading to unauthorized disclosure of confidential data. There is no indication of impact on integrity or availability. No known exploits have been reported in the wild, and the attack requires local access with low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to systems running affected IBM Db2 versions to trusted users only. Monitor IBM security advisories for updates on patches or official mitigations.