EUVD-2026-83016
GHSA-x437-8gwg-vphp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to MQ queue manager
-
DeliveryCraft malicious MQINQ request
-
ExploitTrigger integer overflow in validation
-
ExecutionCorrupt heap memory
-
ImpactCrash service or escalate privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated MQ session (PR:L) against IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40, and the attacker must send a specially crafted MQINQ (MQ inquire) request whose values trigger the integer overflow in request validation. Limiting factors: valid MQ credentials are required (not anonymous/unauthenticated), the AC:H rating indicates the overflow condition is non-trivial to hit reliably, and exploitation is confined to the specialized HPE NonStop platform running the affected 8.1.0.x releases; a vendor patch is already available, so patched deployments are not exposed. |
| Impact | This is a real but moderate-priority issue whose risk is meaningfully bounded by preconditions. The vendor CVSS of 7.5 is driven by full C:H/I:H/A:H impact, but the vector itself qualifies severity heavily: AC:H (the integer overflow in MQINQ request validation requires crafting a request that hits a specific boundary condition) and PR:L (the attacker must already be an authenticated MQ user). Per the CVSS vector containing PR:L, this is an authenticated attack - not remote-unauthenticated. Exploitation status: no public exploit identified at time of analysis - there is no EPSS score, no CISA KEV listing, and no POC referenced in the input, so there is no evidence of active or automated exploitation. Note a description/impact nuance: the text states DoS 'or potentially escalate privileges,' meaning the confidentiality/integrity/privilege-escalation impact is characterized by IBM as potential rather than demonstrated, while the DoS (A:H) is the more clearly-supported outcome - the C:H/I:H are somewhat optimistic for a 'potentially' qualifier. Overall: a genuine authenticated DoS/heap-corruption bug on a niche platform, patch already available, no exploitation signals - patch on normal cycle rather than emergency, but prioritize where MQ for HPE NonStop is business-critical. |
| Exploit ScenarioDerived | An attacker with valid (low-privilege) IBM MQ credentials on an HPE NonStop queue manager submits a crafted MQINQ (inquire) request whose parameters trigger an integer overflow during validation, corrupting the heap. This most reliably crashes the queue manager (denial of service) and could potentially be leveraged toward privilege escalation. No public proof-of-concept is known, and the AC:H rating reflects the precise crafting required to hit the overflow. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Heap corruption in IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 allows an authenticated remote user with a valid MQ session to crash the queue manager via a crafted MQINQ inquire request, and the same integer-overflow defect in request validation creates the potential for privilege escalation under specific memory-layout conditions. The issue is rated 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning credentials are required and the overflow is non-trivial to trigger reliably; there is no public exploit code and no public exploit identified at time of analysis, and IBM has published a vendor fix. Risk is further bounded because exploitation is confined to the specialized HPE NonStop platform running the affected 8.1.0.x maintenance levels, so deployments that have applied the patched level are not exposed.
RemediationAI
IBM has released vendor-supplied fixes for this issue; per the input data patch availability is "Available from vendor" and the only reference is the IBM support page at https://www.ibm.com/support/pages/node/7287702, which should be consulted to identify the exact corrected maintenance level to apply - no explicit fix version number is provided in the available data, so do not assume any specific PTF identifier. In practice that means upgrading IBM MQ for HPE NonStop from the affected 8.1.0 through 8.1.0.40 range to the corrected 8.1.0.x level or later published in that bulletin, and confirming afterwards via the installed maintenance level reported on the NonStop system. If immediate patching is not possible, the most effective compensating controls are to restrict who can open MQ sessions at all, since the flaw requires a valid authenticated MQ session (PR:L): configure CHLAUTH channel authentication records and set an MCAUSER on every SVRCONN channel so that remote connections run under a low-privilege identity, and remove +inq / +dsp authority on queues and the queue manager from all accounts that do not strictly need it; the trade-off is that MCAUSER-based mapping and tightened channel authority can break legitimate administrative tooling and monitoring that rely on broad inquire rights, so audit before enforcing. Additionally, limit administrative channel exposure by blocking administrative SVRCONN ports at the network boundary and allowing only known management hosts (this degrades remote administration convenience), and enable queue manager error logging and abend/FDC monitoring so that repeated malformed MQINQ traffic - the likely signature of an attempt - is detected early. These are mitigations, not substitutes for the vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM MQ (formerly WebSphere MQ) is enterprise messaging middleware; the MQI protocol exposes administrative and inquiry operations over channels, and MQINQ is the "inquire" verb used to retrieve attributes of queues, channels and the queue manager itself. MQINQ requests carry selector arrays together with integer counts of selectors and of character/integer attribute values, and the receiving queue manager must validate those counts before sizing the response buffers and computing offsets into them. This vulnerability is rooted in CWE-122 (heap-based buffer overflow) that arises because that validation arithmetic does not correctly bound the integer fields: the tags Buffer Overflow, Heap Overflow, Denial Of Service and IBM MQ for HPE NonStop reflect exactly this class of defect, where an integer overflow in request validation produces an undersized heap allocation that is then overrun. The affected CPE, cpe:2.3:a:ibm:mq_for_hpe_nonstop:*:*:*:*:*:*:*:*, is version-wildcarded, so every 8.1.0.x level from 8.1.0 through 8.1.0.40 on HPE NonStop should be treated as affected. Because the overflow is triggered inside the queue manager process rather than in a client, successful corruption can abend the queue manager (denial of service) or, if the attacker can shape adjacent heap data, alter control flow or object state in a way that could elevate privileges - which is why the assessed vector carries High confidentiality, integrity and availability impact despite the High attack complexity.
Know when Mq For Hpe Nonstop gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable MQ listener (AV:N) but overflow needs precise crafting (AC:H) and valid credentials (PR:L); heap corruption supports DoS (A:H) with vendor-claimed potential priv-esc (C:H/I:H).
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to an integer overflow in MQINQ request validation.
Executive ViewAI
Organizations using IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40 are exposed to a high-severity heap corruption flaw that could let an authenticated remote attacker crash the queue manager or potentially escalate privileges. No public exploit identified at time of analysis, and exploitation requires valid credentials and is non-trivial, but a successful attack could disrupt critical messaging services and compromise data integrity. Leadership should prioritize patching to protect high-value transactional workloads on this specialized platform.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Mq For Hpe Nonstop
View allHeap buffer underflow in IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 allows an authenticated remote attacker to crash
Heap-based memory corruption in the IBM MQ for HPE NonStop queue manager lets an attacker who already holds a valid, low
Heap-based buffer overflow in the IBM MQ C client shipped with IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 lets a remo
Improper validation of message header offset values in IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 allows an authentic
IBM MQ on HPE NonStop 8.0.4 and 8.1.0 is vulnerable to a privilege escalation attack when SharedBindingsUserId is set to
IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40 contain a heap-based buffer overflow (CWE-122) that is triggered
IBM MQ on HPE NonStop 8.0.4 and 8.1.0 is vulnerable to a privilege escalation attack when running in restricted mode. Ra
IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD, IBM MQ Appliance 9.3 LTS, 9.3 CD, 9.4 LTS, and IBM MQ for HPE
IBM MQ for HPE NonStop 8.0.4 and 8.1.0 could allow a remote authenticated attacker could cause a denial of service due t
IBM MQ, IBM MQ Appliance, IBM MQ for HPE NonStop 8.0.4 and 8.1.0 could allow an attacker to cause a denial of service ca
IBM MQ (IBM MQ for HPE NonStop 8.1.0) can inadvertently disclose sensitive information under certain circumstances to a
Exploit-DB