Loading vulnerability…
RCE in IBM Informix oninit sq_sgkprepare
CVE-2026-13361 is a remote code execution vulnerability in the SQL Interface component of IBM Informix Dynamic Server. The flaw is caused by an unchecked SQL Interface length field in the oninit sq_sgkprepare code path. An authenticated SQL Interface client can send a specially crafted request that triggers a stack-based buffer overflow, potentially allowing attacker-controlled execution within the context of the Informix server process. Affected versions include Informix Dynamic Server 12.10.x, 14.10, and 15.0.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can lead to remote code execution on the target Informix server. Given the stack-based buffer overflow condition and the assigned CVSS vector, exploitation may enable compromise of confidentiality, integrity, and availability, including execution of arbitrary code in the security context of the vulnerable server process.
If you can’t patch tonight, do this now.
No vendor workaround or mitigation has been identified. If immediate patching is not possible, risk reduction would depend on limiting exposure of the SQL Interface to only trusted clients and tightly restricting network access, but the vendor states no formal mitigations are available.
Patch, then assume compromise.
Upgrade IBM Informix Dynamic Server to a fixed release. IBM states the issue is fixed in Informix 14.10.xC13W13 and 15.0.1.14. Customers should apply the vendor-provided fixes and follow IBM Informix server upgrade guidance for their deployment. Information currently available does not identify a fixed 12.10.x release in the provided material, so affected 12.10.x deployments should follow IBM support guidance for an appropriate upgrade path.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.