Multiple command-line parameter format string vulnerabilities have been discovered in various IBM DB2 binaries. Specifically, format-based functions are implemented erroneously within the db2govd, db2start, and db2stop programs. These binaries are typically installed setuid, allowing a malicious local user to gain elevated privileges. An example of this exploit is shown above, where a malicious user can cause a segmentation fault by entering %n%n as a command-line parameter.