EUVD-2026-104471
GHSA-wvhw-jq53-22mq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with valid MQ client credentials
-
ExploitSend specially crafted client request
-
ExecutionTrigger out-of-bounds read in request parser
-
ImpactLeak partial memory layout and cause limited DoS
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated MQ client session (CVSS PR:L) that can reach the queue manager and submit a specially crafted client request which the server mis-parses, triggering the out-of-bounds read. It applies to the IBM MQ Operator and MQ Advanced Container Images deployments named in the CPEs. Limiting factors: the attacker must already possess valid MQ credentials and network reachability to the listener; there is no code execution or data tampering, only a bounded denial of service and partial memory-layout disclosure, which materially caps real-world impact. |
| Impact | This is a genuinely medium-tier, not high-priority, issue and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L, base 5.4) describes a network-reachable but authenticated (PR:L) flaw with only limited confidentiality (C:L - partial memory-layout disclosure) and limited availability (A:L - bounded denial of service) impact, and no integrity impact. There is no memory corruption leading to code execution here: the description specifies an out-of-bounds READ, so despite the CWE-122 (heap-based buffer overflow) classification and the 'Buffer Overflow'/'Heap Overflow' tags, the realistic worst case is a crash/partial info leak, not RCE - this CWE/description tension should be verified against the IBM advisory. No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization; the authentication requirement (a valid MQ client connection) further constrains who can attack. Net: a patch-in-normal-cycle issue, not an emergency. |
| Exploit ScenarioDerived | An attacker who already holds valid IBM MQ client credentials connects to the queue manager and sends a specially crafted client request that triggers an out-of-bounds read while the request is parsed. This causes a limited denial of service (e.g., a disrupted connection/process) and may leak small fragments of process memory-layout information that could aid in profiling the target. No public exploit code was identified at time of analysis, and the network attack vector is gated by the required authentication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Authenticated IBM MQ clients can cause a bounded denial of service and obtain limited information about process memory layout in IBM MQ Operator and IBM MQ Advanced Container Images deployments by sending a specially crafted request that triggers an out-of-bounds read. The issue requires a valid MQ client session and network access to the queue manager listener, and impact is limited to availability and low-confidentiality disclosure rather than code execution or data modification. No public exploit was identified at time of analysis, and IBM has published a vendor patch.
RemediationAI
IBM has released a patch; obtain the fixed IBM MQ Operator and IBM MQ Advanced Container Images release through the vendor advisory at https://www.ibm.com/support/pages/node/7292667 and upgrade affected deployments. Because the input does not provide an exact fixed version number, confirm the applicable fix level for each installed operator/container image stream before rolling out. If immediate upgrade is not possible, restrict network access to MQ listener ports to trusted client networks and enforce strong authentication/authorization for MQ client connections, recognizing that this reduces exposure but does not remove the vulnerable parsing path. Monitor queue-manager logs and container health for abnormal restarts or memory-related errors from authenticated clients, and treat unexpected client disconnects or process crashes as potential exploitation attempts; these compensating controls add operational overhead and may not be feasible for broadly accessible MQ endpoints.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-122 (heap-based buffer overflow), manifesting here as an out-of-bounds read while the MQ server parses a crafted client request. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L shows a network-reachable flaw that requires low privileges-specifically an authenticated MQ client session able to reach the queue manager-with no user interaction; the scope is unchanged and the only impacts are low confidentiality and low availability. CPE data identifies IBM MQ Operator and IBM MQ Advanced Container Images as the affected deployment artifacts, so the vulnerable code path is in the MQ server components shipped or managed through those containerized/operator-based distributions. Because the primitive is a read beyond an allocated heap buffer, the attacker can at most disturb process availability in a limited way and infer some memory-layout details; there is no write primitive, code execution, or integrity impact described.
Know when Mq Operator gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Network-reachable parser flaw needing a valid MQ client session gives AV:N/AC:L/PR:L/UI:N; out-of-bounds read yields only C:L (memory-layout leak) and A:L (limited DoS), with I:N.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited information about process memory layout due to an out-of-bounds read when processing a specially crafted client request.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Mq Operator
View allIBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configuration
Heap buffer overflow in IBM MQ Operator and IBM MQ Advanced Container Images lets an authenticated user with authority t
Denial of service and potential remote code execution in IBM MQ deployments using the MQ Operator and MQ Advanced Contai
Authenticated users of containerized IBM MQ deployments can cause denial of service or memory corruption by sending MQOP
IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically define
Unauthenticated remote code execution is possible against IBM MQ deployments exposed through the MQ Operator and MQ Adva
Authenticated attackers with access to IBM MQ Operator or MQ Advanced Container Images deployments can exploit unrestric
IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 IBM MQ Container Developer Edition is vulnerable to denial of service c
IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2
IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0,
Denial of service in IBM MQ Operator and IBM MQ Advanced container images lets an authenticated MQ client crash the queu
Authenticated denial of service in IBM MQ container deployments - specifically the MQ Operator and MQ Advanced container
Exploit-DB