EUVD-2026-83037
GHSA-3qp5-vm6w-4rrg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to queue manager with put authority
-
DeliverySend MQPUT to crafted distribution list
-
ExploitTrigger integer overflow in distribution list processing
-
ExecutionCorrupt heap / crash queue manager
-
ImpactDenial of service or potential code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated MQ session (PR:L) with authorization to PUT messages to a distribution list - the overflow occurs specifically during distribution list processing of a crafted MQPUT (likely via malformed distribution-header/MQDH count or length fields). Exploitation is limited by the need for valid credentials and put/queue authority on a reachable queue manager; it is not exploitable by fully unauthenticated attackers. No user interaction is required. The RCE outcome is not confirmed and may not be achievable; DoS (queue manager crash) is the reliably reachable impact against affected IBM MQ versions. |
| Impact | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with full CIA impact. The full C:H/I:H/A:H triad rests on the 'potentially execute arbitrary code' language; the description hedges this ('or potentially'), so denial of service is the confirmed outcome while RCE is unproven and vendor-qualified - the true impact may be closer to A:H/DoS-only. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so this is not confirmed actively exploited and no public exploit code exists at time of analysis; it should be treated as a patch-priority based on severity and product ubiquity rather than on evidence of exploitation. The key limiting factor absent from the raw 8.8 is PR:L: an attacker needs valid credentials and authorization to a queue/channel able to submit distribution-list PUTs, which meaningfully narrows the exploit population to insiders or attackers who have already obtained MQ credentials. No SSVC decision data was provided. Integer overflows of this class (CWE-190) frequently manifest as reliable crashes but only sometimes as controllable memory corruption, reinforcing that DoS is the realistic near-term risk. |
| Exploit ScenarioDerived | An attacker holding valid IBM MQ credentials with authority to put messages connects to a queue manager and issues an MQPUT to a distribution list crafted so the count/size fields overflow an integer during distribution-list processing. This corrupts memory and crashes the queue manager (DoS), and per the vendor could potentially be leveraged for code execution. No public proof-of-concept is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Integer overflow (CWE-190) in IBM MQ distribution list processing lets an authenticated user with PUT authority to a distribution list send a crafted MQPUT message that corrupts memory handling, reliably crashing the queue manager and potentially enabling arbitrary code execution. The flaw is network reachable with low complexity and no user interaction (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High), but requires a valid MQ session plus put/queue authority on a reachable queue manager, so it is not exploitable by unauthenticated attackers. No public exploit code or confirmed active exploitation has been identified at time of analysis; an RCE outcome is not confirmed and the reliably achievable impact against affected versions is denial of service, while IBM has published a vendor fix.
RemediationAI
IBM has released a vendor patch - see the advisory at https://www.ibm.com/support/pages/node/7284945 for the specific fix pack/APAR applicable to each MQ version (the input data does not include an exact fix version, so confirm the target release there before upgrading). Where patching cannot be immediate, the most effective compensating control is to restrict the privilege that the flaw requires: revoke or narrowly scope PUT authority to distribution lists so only trusted, audited principals can issue such MQPUTs, accepting the trade-off that legitimate fan-out publishing tied to those identities must be re-permissioned or moved to a service account. Additionally, remove or avoid defining distribution lists that are not actively required, and restrict channel reachability (for example via channel authentication rules and network ACLs) so only known application hosts can connect - the trade-off being added operational overhead for every new client host. Because exploitation is authenticated, tightening channel authentication and monitoring for anomalous PUT patterns against distribution lists reduces exposure, but these measures do not replace applying the vendor fix. Note that crash-level denial of service remains reachable for any principal that retains the required put authority, so privilege reduction should be treated as the primary mitigation until the patch is installed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM MQ is an enterprise message-oriented middleware product; distribution lists let a single MQPUT fan a message out to multiple destination queues, and the queue manager parses the accompanying distribution-header structures (such as MQDH/MQOR-style fields carrying destination counts and lengths) when expanding that PUT. CWE-190 (Integer Overflow or Wraparound) in this parsing/dispatch path means a malformed count or length field can wrap an arithmetic calculation used for sizing or indexing, producing incorrect buffer arithmetic that leads to memory corruption - with high integrity and availability impact and a plausible but unproven path to code execution given MQ queue managers typically run with significant privileges. The supplied CPE, cpe:2.3:a:ibm:mq:*:*:*:*:*:*:*:*, uses a wildcard version field, so it does not by itself enumerate the affected releases; the authoritative fix pack and APAR versions must be read from the IBM advisory. The assessed vector (PR:L) confirms this is an authenticated-only primitive rather than an unauthenticated remote defect, and the RCE consequence described in the vendor text should be treated as a worst case rather than a demonstrated outcome.
Know when Mq gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable MQPUT with only low-priv credentials (PR:L) and no UI; I retain vendor C:H/I:H/A:H since RCE is vendor-claimed, though DoS/A:H is the confirmed impact.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in distribution list processing.
Executive ViewAI
IBM MQ queue managers face a high-severity memory corruption issue (CVE-2026-11378) that an authenticated user with PUT authority to a distribution list could leverage to crash the queue manager and potentially execute arbitrary code. The reliably achievable impact is denial of service against messaging infrastructure, which can disrupt dependent applications and business processes until service is restored. Leadership should prioritize patching and restrict PUT privileges because the flaw is network reachable with low complexity, though it requires a valid MQ session and specific queue authority.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Remote code execution in IBM MQ is possible when the optional IVT (Installation Verification Test) application is deploy
Malformed compressed data delivered over an IBM MQ channel that has compression enabled can trigger an out-of-bounds hea
IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack wh
IBM MQ queue managers that process XA (X/Open distributed) transactions are vulnerable to a memory-corruption buffer ove
Authenticated remote code execution in IBM MQ lets an attacker who holds valid MQ credentials - or who can reach a chann
Heap-based buffer overflow in IBM MQ allows an authenticated, low-privilege attacker who can reach a queue manager to ca
An integer overflow in IBM MQ's MQINQ (inquire object attributes) request processing lets an authenticated remote user c
IBM MQ queue managers running affected releases can be crashed - and, per IBM, potentially have arbitrary code executed
IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their privileges under certain configurations du
Unsafe Java object deserialization in IBM MQ (9.1.0.0-9.1.0.37 LTS, 9.2.0.0-9.2.0.43 LTS, 9.3.0.0-9.3.0.41 LTS / 9.3.0.0
A heap buffer overflow in the IBM MQ client (CWE-787) can be triggered when the client processes crafted messages delive
IBM MQ versions 9.1.0.0 through 9.4.5.1 across LTS and CD streams and 10.0.0.0 are affected by a JNDI injection flaw tha
Exploit-DB