EUVD-2026-104474
GHSA-w4mc-h76j-j926
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to IBM MQ queue manager
-
DeliverySend crafted MQOPEN with malformed buffer size
-
ExploitBypass buffer size validation
-
ExecutionCorrupt queue manager process memory
-
ImpactCrash service or hijack execution
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | The attacker must be authenticated to an affected IBM MQ queue manager (CVSS PR:L) and able to issue MQOPEN API calls - i.e., possess valid MQ connection credentials and authority to open a queue or object. The flaw is reachable over the network (AV:N) with no user interaction (UI:N) and low attack complexity (AC:L). Exploitation is limited to the containerized deployment variants named in the CPE data - IBM MQ Operator and MQ Advanced Container Images (typically Kubernetes/OpenShift deployments) - rather than all IBM MQ installations. The requirement for valid MQ credentials is the primary limiting factor; environments that expose MQ only to trusted, authenticated application clients face lower realistic risk than those permitting untrusted authenticated connections. |
| Impact | The vendor CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with high impact across confidentiality, integrity and availability. In practice PR:L means an attacker must already hold valid credentials to connect to the queue manager and issue an MQOPEN call, so this is an authenticated issue, not a pre-auth internet-facing one - that materially lowers real-world exposure versus the raw 8.8 score. The C:H/I:H/A:H rating appears driven by the 'corrupt memory' outcome (memory corruption can escalate beyond pure DoS to code execution affecting confidentiality and integrity); the description itself only explicitly guarantees denial of service or memory corruption, so the full C/I/A=High may be a worst-case vendor interpretation rather than demonstrated RCE. EPSS exploitation probability was NOT provided in the input and cannot be stated. KEV status is not listed (not in CISA KEV), and no POC or exploit reference is present, so exploitation status is 'no public exploit identified at time of analysis.' Net assessment: a genuine high-severity patch-now item for exposed IBM MQ container/operator deployments where untrusted or semi-trusted clients can authenticate, but the authentication requirement means it is lower priority than an equivalent unauthenticated flaw, and the absence of EPSS/KEV/POC signals suggests no evidence of active exploitation at this time. |
| Exploit ScenarioDerived | An attacker who already holds valid credentials to an affected IBM MQ queue manager connects over the network and issues an MQOPEN operation containing a malformed buffer-size value. Because buffer sizes are not properly validated, the request crashes the queue manager (denial of service) or corrupts process memory, which could potentially be leveraged toward further compromise. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Authenticated users of containerized IBM MQ deployments can cause denial of service or memory corruption by sending MQOPEN operations that are not properly validated for buffer size. The affected deployments identified in the CPE data are IBM MQ Operator and IBM MQ Advanced Container Images, with the provided feed using wildcard version fields rather than a precise version range. The vendor CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring valid MQ credentials and authority to open a queue or object; no public exploit was identified at time of analysis, and a vendor patch is available via IBM support advisory node 7292667.
RemediationAI
Apply the vendor-released fix identified in IBM advisory https://www.ibm.com/support/pages/node/7292667; the provided data confirms patch availability but does not specify an exact fixed version, so verify the corrected IBM MQ Operator and MQ Advanced Container Images versions directly in the advisory before upgrading. Until patched images are deployed, restrict network access to MQ listener ports so that only trusted application clients can connect, noting that overly broad firewall restrictions can break legitimate messaging integrations. Enforce least-privilege MQ authorities so that only required identities can issue MQOPEN calls against sensitive queues and objects, with the trade-off that reducing authorities may disrupt application workflows if permissions are not mapped carefully. Monitor for anomalous MQOPEN operations and repeated connection failures from authenticated clients, and prioritize environments that allow less-trusted authenticated connections. No public exploit was identified at time of analysis, but the authenticated network-reachable nature of the flaw and the high CVSS impact warrant prompt patching of exposed containerized MQ deployments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM MQ provides messaging middleware, and the MQOPEN API call is used by applications to open queues, topics, or other MQ objects. The described issue concerns improper validation of buffer sizes during MQOPEN processing, which can lead to memory corruption or a denial-of-service condition when an authenticated client supplies crafted parameters. The CPE data scopes the affected products to IBM MQ Operator and IBM MQ Advanced Container Images, i.e., Kubernetes/OpenShift-style containerized MQ deployments, rather than every IBM MQ installation. The assigned CWE is CWE-1223 (Race Condition for Write-Once Attributes), although the description emphasizes buffer-size validation in MQOPEN operations; the CWE mapping should therefore be treated as the vendor/feed classification while impact is assessed from the CVSS vector and described behavior. Exploitation requires network reachability, low privileges, and no user interaction, with high confidentiality, integrity, and availability impact per the assessed vector; the practical prerequisite is a valid MQ connection identity and authority to open the targeted queue or object.
Know when Mq Operator gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable MQOPEN call requires valid MQ credentials (PR:L) but no interaction (UI:N); memory corruption plausibly yields full C/I/A impact, matching vendor rating.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations.
Executive ViewAI
IBM MQ Operator and IBM MQ Advanced Container Images are exposed to a high-severity defect that lets authenticated users with queue-access rights disrupt messaging availability or damage memory integrity in containerized deployments. The issue places business-critical messaging middleware and its dependent applications at risk, while no public exploit was identified at time of analysis and a vendor fix is available. Leadership should prioritize remediation for production and externally reachable MQ estates.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Mq Operator
View allIBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configuration
Heap buffer overflow in IBM MQ Operator and IBM MQ Advanced Container Images lets an authenticated user with authority t
Denial of service and potential remote code execution in IBM MQ deployments using the MQ Operator and MQ Advanced Contai
IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically define
Unauthenticated remote code execution is possible against IBM MQ deployments exposed through the MQ Operator and MQ Adva
Authenticated attackers with access to IBM MQ Operator or MQ Advanced Container Images deployments can exploit unrestric
IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 IBM MQ Container Developer Edition is vulnerable to denial of service c
IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2
IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0,
Denial of service in IBM MQ Operator and IBM MQ Advanced container images lets an authenticated MQ client crash the queu
Authenticated denial of service in IBM MQ container deployments - specifically the MQ Operator and MQ Advanced container
Authenticated users of IBM MQ Operator and IBM MQ Advanced container image deployments can cause a denial of service aga
Exploit-DB