TI-2025-01733 Aliases CVE-2025-1991 GHSA-h658-g68v-wgc7

IBM Informix Dynamic Server denial of service

LOW 39CWE-191Published 2025-06-28 · Updated 2025-08-24

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-191 and the CVSS impact.

Summary

IBM Informix Dynamic Server 12.10,14.10, and15.0 could allow a remote attacker to cause a denial of service due to an integer underflow when processing packets.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00442 38th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
IBM	Informix Dynamic Server	12.10; 14.10; 15.0	—	No fix listed	CNA

Informix Dynamic Server VendorIBM Affected 12.10; 14.10; 15.0 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:ibm:informix_dynamic_server:12.10:-:::-:::*	12.10	Vulnerable	IBM
cpe:2.3:a:ibm:informix_dynamic_server:14.10:-:::-:::*	14.10	Vulnerable	IBM
cpe:2.3:a:ibm:informix_dynamic_server:15.0:-:::-:::*	15.0	Vulnerable	IBM

cpe:2.3:a:ibm:informix_dynamic_server:12.10:-:*:*:-:*:*:* Versions 12.10 Vulnerable ·IBM
cpe:2.3:a:ibm:informix_dynamic_server:14.10:-:*:*:-:*:*:* Versions 14.10 Vulnerable ·IBM
cpe:2.3:a:ibm:informix_dynamic_server:15.0:-:*:*:-:*:*:* Versions 15.0 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-1991
2026-10-03 Alias added: GHSA-h658-g68v-wgc7

References

Patch 1

https://www.ibm.com/support/pages/node/7238455

TI-2009-02627 Integer signedness error in the authentication functionality in librpc.dll in the… CVSS 2.0HIGH 10.0
TI-2009-02626 Multiple buffer overflows in the authentication functionality in librpc.dll in the… CVSS 2.0HIGH 10.0
TI-2010-03848 Integer overflow in librpc.dll in portmap.exe (aka the ISM Portmapper service) in ISM… CVSS 2.0HIGH 10.0
TI-2008-00734 Multiple stack-based and heap-based buffer overflows in the Windows RPC components for… CVSS 2.0HIGH 10.0
TI-2011-00892 Stack-based buffer overflow in oninit in IBM Informix Dynamic Server (IDS) 11.50 allows… CVSS 2.0HIGH 9.3
TI-2008-00912 Unspecified vulnerability in IBM Informix Dynamic Server (IDS) 7.x through 11.x allows… CVSS 2.0HIGH 10.0

See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences