IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involving a predictable Unix… (CVE-2026-18567)

CVE-2026-18567 describes a race condition vulnerability in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. The issue arises from the use of a predictable Unix domain socket path within a world-writable directory, which can be exploited by a local attacker to gain unauthorized information disclosure. The vulnerability is classified under CWE-367 (Time-of-check Time-of-use (TOCTOU) race condition). The CVSS 3.1 vector indicates low attack complexity, low privileges required, no user interaction, and limited confidentiality impact.

A local attacker with limited privileges could exploit this race condition to obtain information that should otherwise be protected. The impact is limited to confidentiality loss without affecting integrity or availability. There are no known exploits in the wild reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for suspicious local activity related to Unix domain socket usage in the affected directories.