CVE-2026-18567: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition in IBM Db2 Mirror for i

CVE-2026-18567 describes a TOCTOU race condition in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. The vulnerability involves a predictable Unix domain socket path within a world-writable directory, enabling a local attacker to exploit the timing window between the check and use of the socket path to gain unauthorized information. The CVSS v3.1 vector indicates low attack complexity and low privileges required, with no user interaction needed, affecting confidentiality and availability to a limited extent. No vendor advisory or patch information is currently available.

A local attacker with low privileges could exploit this race condition to obtain sensitive information from the system. The impact is limited to confidentiality and availability, with no integrity impact reported. The vulnerability does not appear to be exploited in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting local access to the affected system and monitoring for suspicious activity related to Unix domain socket usage. Avoid placing sensitive sockets in world-writable directories.