IBM DB2 Merge Backup vulnerabilities

3 CVEs affecting IBM DB2 Merge Backup, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-33130, published 2026-02-17.

More from IBM.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-33130, published 2026-02-17. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM DB2 Merge Backup for Linux, UNIX and Windows 12.1.0.0 could allow an authenticated user to cause the program to crash due to a buffer being overwritten when it is allocated on the stack.
• CVE-2025-33124, published 2026-02-17. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM DB2 Merge Backup for Linux, UNIX and Windows 12.1.0.0 could allow an authenticated user to cause the program to crash due to the incorrect calculation of a buffer size.
• CVE-2025-13108, published 2026-02-17. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM DB2 Merge Backup for Linux, UNIX and Windows 12.1.0.0 could allow an attacker to access sensitive information in memory due to the buffer not properly clearing resources.