EUVD-2026-104476
GHSA-wgp2-xvpf-xc9h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to queue manager with put authority
-
ExploitIssue MQPUT with malformed message options
-
ExecutionTrigger heap buffer overflow in message processing
-
ImpactCrash queue manager or execute arbitrary code
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated connection to an affected IBM MQ queue manager (container/operator deployment) with authority to perform an MQPUT (place a message on a queue); the attacker then supplies malformed message options to trigger the heap overflow during message processing. Limiting factors: valid MQ credentials and MQPUT/put authority are mandatory (PR:L, not unauthenticated), and only the containerized MQ Operator and MQ Advanced Container Images products are listed as affected, so traditional MQ server installs may fall outside this specific advisory's scope. No user interaction is required (UI:N). |
| Impact | This is a credible, high-priority issue for organizations running IBM MQ in container/Kubernetes form, though not an automatic emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates network-reachable, low-complexity exploitation requiring only low-level privileges (PR:L) and no user interaction, with full confidentiality, integrity, and availability impact - consistent with a heap buffer overflow (CWE-122) that can yield either denial of service or potential arbitrary code execution. The key mitigating signal is PR:L: an attacker must already be an authenticated MQ client with authority to perform MQPUT, so this is not an unauthenticated internet-facing bug. No EPSS score was supplied in the input, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no public exploit was referenced, so this is no public exploit identified at time of analysis - treat the RCE outcome as vendor-stated potential ('potentially execute arbitrary code') rather than demonstrated. The strongest confirmed signal is that IBM has issued a patch. Net: a serious post-authentication flaw in enterprise messaging middleware warranting prompt patching, but the authentication requirement and absence of known exploitation place it below drop-everything status. |
| Exploit ScenarioDerived | An attacker who has obtained valid IBM MQ client credentials (or has compromised an application account with put authority) connects to a queue manager and issues an MQPUT call carrying deliberately malformed message options, overflowing a heap buffer in the message-processing path. The result is at minimum a crash of the queue manager (denial of service to all dependent applications) and potentially arbitrary code execution in the queue manager's context. No public exploit code was identified at time of analysis, so weaponization effort is presently unknown. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Heap buffer overflow in IBM MQ Operator and IBM MQ Advanced Container Images lets an authenticated user with authority to perform MQPUT operations crash the queue manager or potentially execute arbitrary code by supplying malformed message options. The advisory is scoped to these containerized IBM MQ products, and exploitation requires valid MQ credentials plus put authority, so this is not an unauthenticated attack. No public exploit identified at time of analysis, and IBM has released a vendor patch.
RemediationAI
Patch available per vendor advisory: apply the vendor-supplied fix for IBM MQ Operator and IBM MQ Advanced Container Images from IBM support page https://www.ibm.com/support/pages/node/7292667; the supplied data does not include an exact fixed version, so use the vendor-designated patched release for each affected deployment. If immediate patching is not possible, restrict MQPUT/put authority to only trusted applications and service accounts, and limit network reachability to MQ listener ports to trusted application networks; restricting authority can break legitimate producers that require broad put access, and firewall or Kubernetes NetworkPolicy changes may require application-owner coordination. Monitor queue manager crashes and unusual malformed MQPUT traffic as a compensating detection measure, but these controls do not eliminate the heap overflow for an authorized producer.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM MQ is message-oriented middleware, and MQPUT is the MQI call used by producers to place messages onto queues. CVE-2026-10572 is a CWE-122 heap-based buffer overflow reached when malformed message options are processed during an MQPUT operation; improper validation can cause memory corruption, leading to denial of service or potential arbitrary code execution. The CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network-reachable, low-complexity exploitation by an authenticated user (PR:L) with no user interaction, and high confidentiality, integrity, and availability impact. CPE data identifies IBM MQ Operator (cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:*) and IBM MQ Advanced Container Images (cpe:2.3:a:ibm:mq_advanced_container_images:*:*:*:*:*:*:*:*) as the affected products, so the issue is specifically relevant to container/Kubernetes deployments rather than confirmed for every traditional IBM MQ server installation.
Know when Mq Operator gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-facing MQ listener (AV:N) with no special timing (AC:L); exploitation needs an authenticated client with put authority (PR:L); heap overflow enables DoS and potential code execution for full C/I/A impact.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT operations with malformed message options.
Executive ViewAI
IBM MQ Operator and IBM MQ Advanced Container Images are affected by a high-severity vulnerability that can disrupt queue-manager availability and potentially allow code execution by users who already hold MQ message-put permissions. The exposure is concentrated in production messaging environments where MQ credentials or put rights may be over-provisioned or compromised, so leadership should treat this as an availability and privilege-control risk rather than an anonymous internet-facing attack. A vendor fix is available, and no public exploit identified at time of analysis, but patching and MQ authority review should still be prioritized.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Mq Operator
View allIBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configuration
Denial of service and potential remote code execution in IBM MQ deployments using the MQ Operator and MQ Advanced Contai
Authenticated users of containerized IBM MQ deployments can cause denial of service or memory corruption by sending MQOP
IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically define
Unauthenticated remote code execution is possible against IBM MQ deployments exposed through the MQ Operator and MQ Adva
Authenticated attackers with access to IBM MQ Operator or MQ Advanced Container Images deployments can exploit unrestric
IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 IBM MQ Container Developer Edition is vulnerable to denial of service c
IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2
IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0,
Denial of service in IBM MQ Operator and IBM MQ Advanced container images lets an authenticated MQ client crash the queu
Authenticated denial of service in IBM MQ container deployments - specifically the MQ Operator and MQ Advanced container
Authenticated users of IBM MQ Operator and IBM MQ Advanced container image deployments can cause a denial of service aga
Exploit-DB