IBM MQ EUVD-2026-83014

Requires authenticated, low-privilege access (PR:L) to an IBM MQ queue manager - i.e., an authorized channel/application identity permitted to open and PUT to a queue. The attacker must be able to issue an MQPUT operation carrying a crafted/malformed distribution header (the MQDH distribution-list header used for distribution lists). Exploitation is remote over the network (AV:N) with no user interaction (UI:N) and low complexity (AC:L). Limiting factors: valid MQ credentials or an accepted channel identity are mandatory (channel authentication records/MCAUSER hardening and least-privilege queue authorities reduce the exposed population), and reliable privilege escalation beyond a crash is unconfirmed. The affected version range is not specified in the input (wildcard CPE), so administrators must confirm their build against IBM node/7287778.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8 High) indicates a network-reachable, low-complexity flaw requiring only low-privilege authentication and no user interaction, with full C/I/A impact. However, the description hedges the impact: DoS is stated affirmatively while privilege escalation is only 'potential', so the C:H/I:H metrics reflect a best-case (worst-case for defenders) heap-corruption outcome that is not confirmed to yield code execution - verify exploitability of the privesc path with IBM. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no public exploit identified at time of analysis; the 8.8 is a capability/severity signal, not evidence of active exploitation. Net: a genuine patch-priority issue for internet- or partner-facing queue managers because PR:L is a low bar in many MQ deployments (any authorized application/channel identity), but the absence of exploitation signals suggests it is not yet under mass exploitation. A vendor patch exists (IBM node/7287778), which makes remediation straightforward and raises the practical priority to 'patch promptly'.

An attacker who holds valid credentials or an authorized channel identity to an IBM MQ queue manager connects and issues an MQPUT carrying a malformed distribution (distribution-list/MQDH) header. The crafted header triggers a heap buffer overflow in the queue manager's message-processing code, crashing the queue manager (DoS) or potentially corrupting heap memory toward privilege escalation. No public exploit code is identified at time of analysis; exploitation requires authenticated access (PR:L), which limits it to insiders or attackers who have already obtained MQ credentials.