The SQL injection language paired with a DoS-only impact is the analytical key here. You're looking at a database engine crash bug, not a traditional injection exploit that steals data or manipulates application logic. The CVE invokes 'improper neutralization of special elements' but the impact is exclusively denial of service — that's a strong signal that a malformed query triggers an unhandled exception or buffer condition in the DB2 for i engine itself, rather than exploiting a security boundary in application code.
This reframing matters because the 'local authenticated attacker' requirement deserves scrutiny. A user who can submit arbitrary SQL on IBM i already has substantial power through native interfaces, RPG programs, or CL commands. The SQL vector might simply be a more convenient or less audited path to triggering the crash than existing interfaces. The EPSS score of 0.00218 reflects this: authenticated local users with SQL access have better ways to cause DoS than crafting specific malformed queries, so weaponization in the wild is minimal.
What changes the risk calculation is IBM i's architecture. On most platforms, a database crash is recoverable — restart the service, restore from backup. On IBM i, the database IS the operating environment. Job control, system values, user profile authentication, and subsystem management all route through DB2 for i. A crash doesn't just deny service; it can corrupt job tables, compromise subsystem definitions, and alter system values in ways that survive what we naively call 'recovery.' The blast radius extends far beyond the database to the entire partition.
The CVSS 7.8 captures the direct impact correctly, but the EPSS and CVSS together miss the temporal dimension. IBM i environments treat PTF application as an operational risk requiring testing cycles and change management approval. The median time from CVE disclosure to broad deployment runs weeks or months, not days. That means disclosure itself becomes an exposure escalation event — your attack surface expands the moment the CVE drops because every red-team operator knows exactly where to probe.
Monitor your PTF deployment pipeline closely. If you have authenticated users with SQL access, this vulnerability represents a post-compromise force multiplier: an attacker with already-obtained credentials doesn't need to find privilege escalation paths, they can simply crash the engine and let the collateral destabilization work for them. Prioritize testing and deploying the relevant PTF faster than your normal maintenance cycle warrants.