CVE-2026-13361

IBM has disclosed a high-severity vulnerability in Informix's SQL interface layer (CVE-2026-13361, CVSS 8.8) involving an unchecked length field in the sq_sgkprepare function. This is remote code execution in the database engine itself — any client capable of sending queries can potentially own the database. The 8.8 score is notable precisely because it isn't higher; this suggests the vulnerable code path isn't universally reachable through standard SQL queries, likely requiring non-standard client paths or specific query patterns. That's your first priority: determine which of your application tiers and query paths actually exercise sq_sgkprepare. The distinction between 'exposed' and 'internal' interfaces is critical — the original developers may have assumed this boundary was never externally callable, and that assumption calcified into absent validation. The deeper problem is that this isn't a newly introduced flaw — it's a class of vulnerability that emerges at binary protocol boundaries where length metadata must be trusted and acted upon without defensive programming. The phrase 'unchecked length field' could mean validation is absent entirely, bypassable through an alternate call path, or present but incorrect (integer overflow, signed/unsigned confusion). IBM's patch may address only the specific instance, leaving similar orphaned-trust patterns elsewhere in the SQL interface layer. Request clarity from IBM on whether this is a one-off fix or an interface-contract remediation. Your immediate actions: inventory all Informix deployments and versions, determine the exposure surface through your specific query paths, apply the IBM patch immediately, and audit other SQL interface boundaries in the same codebase for comparable unchecked-length patterns. The vulnerability exists at the database hub — exploitation doesn't compromise one system but potentially every downstream system that receives data from Informix.

Reviewed through automated stages and approved by a human before publication.