EUVD-2026-104475
GHSA-rxph-59r7-6v5x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to MQ queue manager
-
DeliveryCraft MQPUT with malformed message handle properties
-
ExploitOverflow heap buffer in property processing
-
ExecutionCrash queue manager or corrupt heap
-
ImpactDenial of service or potential code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to hold valid authenticated access/connection authority to an IBM MQ queue manager (PR:L) and the ability to perform MQPUT or MQPUT1 put operations onto a queue. The specific trigger is a message constructed with malformed message handle properties that are parsed during the put operation. No user interaction is required (UI:N) and the vector is network-reachable (AV:N). The principal limiting factor is the authentication/authorization requirement - the attacker must already be a credentialed MQ client or have compromised such credentials - making this an insider or post-foothold risk rather than an anonymous remote exploit; applies to IBM MQ deployed via the MQ Operator and MQ Advanced Container Images. |
| Impact | This is a credible, actionable priority rather than a high-CVSS-but-low-risk issue, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with full confidentiality, integrity, and availability impact - consistent with the description's claim of denial of service or potential arbitrary code execution. The signals are internally coherent: the heap buffer overflow (CWE-122) triggered during MQPUT/MQPUT1 processing aligns with the network attack vector because an authenticated MQ client can submit put operations remotely. The key tempering factor is PR:L - exploitation requires the attacker to already hold valid credentials or connection authority to a queue manager, so this is primarily an insider or post-compromise escalation risk, not an open internet-facing unauthenticated takeover. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or available exploit code; the 'arbitrary code execution' outcome is described by the vendor as 'potential,' meaning RCE is theorized/plausible but DoS is the more reliable realistic outcome. Prioritize patching given a fix exists and the product's enterprise role, but note exploitation probability data (EPSS) is missing and cannot be used to refine urgency. |
| Exploit ScenarioDerived | An attacker who already possesses valid credentials or authorized client access to an IBM MQ queue manager connects and issues an MQPUT or MQPUT1 operation carrying a message with deliberately malformed message handle properties. The malformed properties overflow a heap buffer during processing, most reliably crashing the queue manager (denial of service) and potentially corrupting heap memory to achieve arbitrary code execution. No public exploit identified at time of analysis; because attack complexity is low (AC:L) and no user interaction is needed, a credentialed attacker could script this reliably once the flaw is understood. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Denial of service and potential remote code execution in IBM MQ deployments using the MQ Operator and MQ Advanced Container Images result from a heap buffer overflow when an authenticated attacker with put authority sends MQPUT or MQPUT1 operations carrying malformed message handle properties. The CVSS 8.8 vector is network-reachable and requires no user interaction, but the PR:L component means the attacker must already hold valid credentials and put permissions, so the practical threat is an insider or post-compromise actor rather than an unauthenticated remote attacker. No public exploit code was identified at time of analysis, and IBM has released a vendor patch.
RemediationAI
Vendor patch is available per IBM advisory https://www.ibm.com/support/pages/node/7292667; apply the fixed level specified in that advisory to all MQ Operator and MQ Advanced Container Images deployments. If immediate upgrade is not possible, reduce exposure by restricting MQPUT and MQPUT1 authority to only trusted applications and users (trade-off: may break legitimate producer workflows), enforcing least-privilege channel authentication and connection authority so low-privileged clients cannot reach queue managers (trade-off: requires careful MQSC/CHLAUTH review and testing), and monitoring queue-manager logs for abends or malformed message handle property anomalies. Network segmentation that limits MQ client connections to trusted application tiers also lowers the attack surface but does not eliminate the need for the patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a heap-based buffer overflow (CWE-122) in IBM MQ's processing of message handle properties during MQPUT and MQPUT1 put operations. Message handles let applications associate put messages with properties; malformed property data causes the queue manager to write beyond the bounds of a heap allocation, corrupting memory. This can crash the queue manager (denial of service) or, depending on heap layout and exploitation primitives, potentially be leveraged for arbitrary code execution. The CPE data ties affected deployments to IBM MQ Operator and IBM MQ Advanced Container Images with wildcard versions, indicating the issue is in the containerized IBM MQ distribution. The CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector confirms network reachability and no user interaction, but PR:L means the attacker must first authenticate and hold authority to perform put operations, which limits exposure to credentialed MQ clients or attackers who have already compromised such credentials.
Know when Kubernetes gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Authenticated MQ client reaches the flaw over the network via a put operation (AV:N/PR:L/AC:L/UI:N); heap overflow enables DoS and potential in-process RCE, giving full C/I/A within an unchanged scope.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties.
Articles & Coverage 2
Executive ViewAI
IBM MQ deployments using the MQ Operator and MQ Advanced Container Images face a high-severity issue that could let an authenticated user with message-put permissions disrupt business messaging and potentially execute unauthorized code. The primary exposure is from insiders or compromised accounts with legitimate access, so leadership should prioritize privileged-access oversight and resilience for business-critical message flows. No public exploit identified at time of analysis, and IBM has released a patch.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Authenticated Typebot users can abuse the webhook block (HTTP Request component) in versions prior to 3.13.1 to issue ar
Exploit-DB