EUVD-2026-104463
GHSA-4g2h-hc9p-x32m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to IBM MQ queue manager
-
DeliveryCraft oversized malicious object name
-
ExploitTrigger off-by-one buffer overflow
-
ExecutionDestabilize or crash MQ process
-
ImpactDisrupt message processing availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Off-by-one prevention
|
| Exploitation Conditions | Exploitation requires (1) valid authenticated access to an IBM MQ queue manager - the CVSS PR:L confirms authentication is mandatory, so this is not reachable by anonymous remote attackers; and (2) the ability to submit a specially crafted, malformed object name that triggers the off-by-one condition during object-name processing. The affected deployments are specifically the IBM MQ Operator and MQ Advanced Container Images (containerized/Kubernetes-based MQ), per the CPE data, so non-container MQ installations may be out of scope. The primary limiting factor is the authentication requirement, which restricts the attack to insiders or attackers who have already obtained MQ credentials; impact is bounded to availability (process instability/crash) with no path to data disclosure or code execution. |
| Impact | This is a genuinely low-priority issue despite the alarming 'buffer overflow' framing. The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) tells a consistent, limited story: while the attack is network-reachable with low complexity and no user interaction, it requires valid authentication (PR:L) and yields ONLY a low availability impact (A:L) with zero confidentiality or integrity impact. The CWE-193 (off-by-one) combined with the description's phrasing 'potential process instability' indicates a crash/denial-of-service-class defect, NOT the arbitrary code execution that 'buffer overflow' typically implies - the vendor explicitly scoped impact to availability only. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so exploitation probability cannot be quantified; however, the absence of KEV/POC signals combined with the requirement for authenticated access and the merely-availability impact strongly suggests this is a high-visibility-low-real-risk issue rather than an urgent threat. The one caveat: an authenticated MQ user base in enterprise messaging environments can be large, so in multi-tenant or shared-queue-manager deployments the authentication barrier is lower than it appears. |
| Exploit ScenarioDerived | An attacker who already holds valid IBM MQ credentials (or has compromised a low-privilege application account) connects to the queue manager and submits a request referencing a specially crafted, oversized object name that triggers the off-by-one write. This destabilizes or crashes the MQ process, disrupting message delivery for dependent applications. No public exploit code is known, and because confidentiality and integrity are unaffected, the realistic payoff is denial of service rather than data compromise or code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Authenticated IBM MQ users holding valid queue-manager credentials can trigger an off-by-one buffer overflow by submitting a specially crafted object name, causing process instability or a crash of MQ components. The impact is availability-only (CVSS 4.3, PR:L, A:L) with no path to data disclosure or code execution, and the CPE data confines affected deployments to containerized environments - IBM MQ Operator and IBM MQ Advanced Container Images - rather than traditional MQ installations. No public exploit code or confirmed active exploitation was identified at time of analysis, and the mandatory authentication step sharply limits exposure to insiders or attackers who have already obtained MQ credentials.
RemediationAI
A vendor patch is available: consult IBM's advisory at https://www.ibm.com/support/pages/node/7292667 to identify the corrected MQ Operator release and MQ Advanced Container Image tag, then upgrade the operator and redeploy the container images; the provided data does not include the exact fixed version numbers, so they must be taken directly from the advisory rather than inferred. Where immediate upgrade is not possible, compensating controls include tightening MQ object authority so that only a small, trusted set of administrative identities can create or alter queue, topic, and channel objects - the trade-off is that broad service accounts and automation that legitimately define MQ objects will break and must be re-scoped and tested; restricting network reachability to the queue manager's administrative interfaces so that only trusted management networks can submit object definitions - at the cost of added operational friction for remote administration; and monitoring MQ error logs and container restart counts for malformed object-name errors or unexpected queue-manager terminations as an early-warning signal, understanding that this is detection rather than prevention.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-193 (Off-by-one Error), a memory-safety class in which a length calculation is off by a single unit, typically because a terminator byte is not accounted for or a comparison uses an inclusive bound where an exclusive one is required. In IBM MQ's object-name processing path, a malformed name supplied by an authenticated user drives a one-byte write past the end of an allocated buffer. Because the overwrite is a single byte into adjacent heap or structure metadata, the realistic outcome is corruption that manifests as a crash or unstable process rather than a controllable write primitive - consistent with the assessed CVSS vector's S:U, C:N, I:N, A:L profile. The affected code ships in the containerized MQ delivery chain identified by the CPE entries cpe:2.3:a:ibm:mq_operator and cpe:2.3:a:ibm:mq_advanced_container_images, meaning Kubernetes/OpenShift deployments managed through the MQ Operator and the corresponding advanced container images, not necessarily bare-metal or VM-based MQ queue managers.
Know when Mq Operator gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
MQ is a network-facing service (AV:N) reachable with low complexity, but requires authenticated access (PR:L); off-by-one causes only process instability, so C:N/I:N/A:L.
Primary rating from Vendor (ibm).
CVSS VectorNVD
DescriptionNVD
IBM MQ could allow an authenticated attacker to cause potential process instability due to an off-by-one buffer overflow when processing specially crafted object names.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
More in Mq Operator
View allIBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configuration
Heap buffer overflow in IBM MQ Operator and IBM MQ Advanced Container Images lets an authenticated user with authority t
Denial of service and potential remote code execution in IBM MQ deployments using the MQ Operator and MQ Advanced Contai
Authenticated users of containerized IBM MQ deployments can cause denial of service or memory corruption by sending MQOP
IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically define
Unauthenticated remote code execution is possible against IBM MQ deployments exposed through the MQ Operator and MQ Adva
Authenticated attackers with access to IBM MQ Operator or MQ Advanced Container Images deployments can exploit unrestric
IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 IBM MQ Container Developer Edition is vulnerable to denial of service c
IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2
IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0,
Denial of service in IBM MQ Operator and IBM MQ Advanced container images lets an authenticated MQ client crash the queu
Authenticated denial of service in IBM MQ container deployments - specifically the MQ Operator and MQ Advanced container
Exploit-DB