EUVD-2026-104469
GHSA-r44r-j5xw-wgw7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege MQ credentials
-
DeliveryCraft malformed multicast status message
-
ExploitSend to multicast-enabled MQ listener
-
ExecutionTrigger NULL pointer dereference
-
ImpactCrash process, denying service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires valid authenticated access to IBM MQ (CVSS PR:L) and, per the description, the ability to send multicast status messages - which in practice means the target MQ deployment (MQ Operator / MQ Advanced container images) must have multicast messaging configured and enabled, a non-default feature not used in most standard queue-manager deployments. The limiting factors are therefore twofold: the attacker must possess legitimate MQ credentials, and the instance must have multicast publish/subscribe enabled; environments not using multicast are not exposed. Impact is confined to availability (process crash / denial of service) with no confidentiality or integrity effect. |
| Impact | This is a moderate-severity, availability-only denial-of-service issue (CVSS 6.5, A:H with C:N/I:N) rather than a top-priority emergency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H indicates a network-reachable attack with low complexity but requiring low-level privileges (PR:L), so the attacker must already be an authenticated MQ user - this materially limits the exposed population versus an unauthenticated flaw. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public proof-of-concept was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. One notable conflict exists in the source data: the CWE is listed as CWE-502 (Deserialization of Untrusted Data) and a 'Deserialization' tag is present, yet the description explicitly states the root cause is a NULL pointer dereference (which maps to CWE-476) triggered by crafted multicast status messages - these are different weakness classes and the discrepancy should be verified against the IBM advisory. Net assessment: a credible but lower-tier DoS requiring authenticated access and, almost certainly, a non-default multicast configuration; patch during normal cycles, prioritizing MQ instances that use multicast messaging and expose it to lower-trust authenticated principals. |
| Exploit ScenarioDerived | An attacker who already holds valid (low-privilege) IBM MQ credentials sends specially crafted multicast status messages to an MQ instance that has multicast messaging enabled, triggering a NULL pointer dereference that crashes the affected process and denies service to legitimate applications. No public exploit code is known, and the low attack complexity (AC:L) means a working request would be simple to reproduce once the malformed message format is understood. Confidentiality and integrity are unaffected - the impact is service disruption only. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Authenticated denial of service in IBM MQ container deployments - specifically the MQ Operator and MQ Advanced container images - lets a remote user who already holds valid MQ credentials crash the queue manager by sending specially crafted multicast status messages that drive the process into a NULL pointer dereference. Impact is availability-only (CVSS 6.5, A:H with C:N/I:N); confidentiality and integrity are unaffected. Exploitation is further constrained because the target deployment must have multicast messaging configured and enabled, a non-default capability absent from most standard queue-manager installations, and no public exploit has been identified at time of analysis.
RemediationAI
Vendor patch status is 'available' but no exact fix version is exposed in the supplied data, so treat this as patch available per vendor advisory: consult IBM's security bulletin at https://www.ibm.com/support/pages/node/7292667 to identify the corrected MQ Operator release and MQ Advanced container image tag, then upgrade the operator and roll the queue-manager pods onto the fixed image (rolling restart causes brief availability interruption per pod). If the update cannot be applied immediately, the most effective compensating control is to disable multicast messaging entirely - remove or do not enable multicast-enabled publish/subscribe on channels and topics - which closes the vulnerable code path; the trade-off is that any multicast pub/sub topology must be reconfigured to unicast, which increases message fan-out overhead and administrative effort. As a secondary measure, restrict network reachability to MQ listener ports to known client hosts and audit MQ credentials so that PR:L access is not broadly granted, since the attack still requires a valid authenticated identity; neither control addresses the underlying deserialization defect, so scheduling the vendor fix remains required.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in IBM MQ's handling of multicast status messages, the control-plane traffic queue managers exchange when reliable multicast publish/subscribe is enabled between MQ nodes. The assigned CWE-502 (Deserialization of Untrusted Data) and the accompanying 'Deserialization' tag indicate that an inbound status message is decoded and materialized into an internal object without sufficient validation of its structure, so a crafted message yields an object with a missing or unpopulated reference; the subsequent dereference of that NULL pointer terminates the queue manager process. The description frames the observable failure as a NULL pointer dereference, while the CWE classifies the underlying root cause as unsafe deserialization - both point to the same trust-boundary problem: multicast status frames from a credentialed peer are treated as well-formed. Because the CVSS vector is PR:L, the attacker must already authenticate to MQ; because multicast pub/sub is an optional, non-default feature, only deployments that have deliberately enabled it expose the vulnerable code path. The CPE entries confirm the affected packaging is the containerized/operator delivery (ibm:mq_operator and ibm:mq_advanced_container_images) rather than classic on-premise MQ installations, though the provided CPE strings are wildcarded and do not pin specific versions.
Know when Mq Operator gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-delivered multicast message (AV:N, AC:L) sent by an authenticated MQ user (PR:L) with no user interaction; crash yields availability-only impact (A:H), no C/I impact, unchanged scope.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially crafted multicast status messages that trigger a NULL pointer dereference.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Mq Operator
View allIBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configuration
Heap buffer overflow in IBM MQ Operator and IBM MQ Advanced Container Images lets an authenticated user with authority t
Denial of service and potential remote code execution in IBM MQ deployments using the MQ Operator and MQ Advanced Contai
Authenticated users of containerized IBM MQ deployments can cause denial of service or memory corruption by sending MQOP
IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically define
Unauthenticated remote code execution is possible against IBM MQ deployments exposed through the MQ Operator and MQ Adva
Authenticated attackers with access to IBM MQ Operator or MQ Advanced Container Images deployments can exploit unrestric
IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 IBM MQ Container Developer Edition is vulnerable to denial of service c
IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2
IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0,
Denial of service in IBM MQ Operator and IBM MQ Advanced container images lets an authenticated MQ client crash the queu
Authenticated users of IBM MQ Operator and IBM MQ Advanced container image deployments can cause a denial of service aga
Exploit-DB