IBM MQ NonStop CVE-2026-11381

Requires an authenticated connection to an IBM MQ for HPE NonStop queue manager with authority to issue an MQPUT (PR:L), then submission of a message whose distribution list structure (the multi-destination MQOD/MQDH recipient records) is malformed to trigger the improper validation. No user interaction is needed (UI:N) and the vector is network-reachable (AV:N), but exploitation is limited to the HPE NonStop build of IBM MQ and requires that the attacker already hold valid credentials/channel access - it is not exploitable pre-authentication against a default configuration.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a low-complexity, network-reachable flaw requiring only low-privilege authentication, with full CIA impact. However, the description itself hedges the worst-case impact ('or potentially execute arbitrary code'), so the C:H/I:H code-execution component is vendor-speculative while the denial-of-service outcome is stated more firmly - this is a classic heap-overflow (CWE-122) where RCE is theoretically possible but not demonstrated. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so real-world exploitation pressure is currently unproven despite the high base score. No SSVC decision data was provided. Crucially, the PR:L metric means an attacker must already possess a valid, authenticated connection to a queue manager (a channel/PUT authority) before reaching the vulnerable distribution-list parsing path, which meaningfully narrows the threat population from pure internet-facing exposure. Net: a genuinely high-severity flaw worth prioritized patching for affected IBM MQ for HPE NonStop deployments, but the absence of any exploitation signals and the authentication precondition place it below drop-everything urgency.

An attacker who already holds authenticated access to an IBM MQ for HPE NonStop queue manager (e.g. a low-privilege application identity or compromised client credential) issues an MQPUT carrying a malformed message distribution list structure. Improper validation of that structure overflows a heap buffer, reliably crashing the queue manager process (DoS) and, per the vendor, potentially corrupting memory to achieve arbitrary code execution. No public proof-of-concept exists at time of analysis.