EUVD-2026-83036
GHSA-98w4-7mr5-93q9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to MQ channel with XA rights
-
DeliveryCraft oversized XA transaction identifier
-
ExploitSubmit transaction to trigger buffer overflow
-
ExecutionCorrupt stack/heap memory in queue manager
-
ImpactCrash service or execute code
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access (PR:L) to an IBM MQ queue manager over a channel that processes XA (X/Open distributed) transactions, then submitting a malformed XA transaction identifier (XID) that overflows a fixed-size buffer during transaction processing. Exploitation is limited by the need for valid MQ credentials and the ability to drive XA/distributed transaction operations, so environments that do not expose XA transaction processing to lower-privileged principals are less exposed; no user interaction is required. Code execution is described only as a potential outcome, whereas denial of service is the reliably achievable impact. |
| Impact | The vendor CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) marks this as high severity, driven by a network-reachable, low-complexity stack buffer overflow in IBM MQ's handling of XA transaction identifiers. The realistic signals are more nuanced: PR:L means an attacker must already hold authenticated access to a queue manager / channel capable of driving XA (distributed) transactions, which meaningfully narrows the attacker population versus a pre-auth flaw. The description frames arbitrary code execution as only 'potentially' possible while denial of service is stated more firmly, so the C:H/I:H components are vendor-hedged best-case outcomes; a reliable DoS (A:H) is the confirmed impact and a memory-safety crash of the queue manager is the most probable real-world result. There is no EPSS score, no CISA KEV listing, and no public exploit code in the provided data, so there is no evidence of active or imminent exploitation - this is a patch-on-normal-cadence priority for exposed/authenticated MQ estates rather than an emergency. Note a data conflict to verify: the description explicitly says 'stack buffer overflow,' yet CWE-122 (heap-based buffer overflow) and the 'Heap Overflow' tag indicate heap corruption - the underlying memory region should be confirmed with IBM's advisory. |
| Exploit ScenarioDerived | An attacker who already holds valid credentials on an IBM MQ channel that permits distributed (XA) transactions submits a transaction with a crafted, over-length XA transaction identifier (XID). The malformed XID overruns a fixed-size buffer during transaction processing, crashing the queue manager (denial of service) and potentially corrupting memory in a way that could lead to code execution. No public proof-of-concept is identified in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
IBM MQ queue managers that process XA (X/Open distributed) transactions are vulnerable to a memory-corruption buffer overflow triggered when a malformed XA transaction identifier (XID) is parsed, allowing an authenticated attacker with network access to crash the queue manager and potentially execute arbitrary code in its context. Exploitation requires valid credentials and the ability to drive XA transaction operations over an MQ channel (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, vendor score 8.8), so the reliably achievable outcome is denial of service while code execution remains a potential, not guaranteed, consequence. There is no public exploit identified at time of analysis and no confirmed active exploitation, but a vendor patch is available and the low attack complexity combined with the complete loss of confidentiality, integrity and availability impact makes prompt remediation important.
RemediationAI
Vendor-released patch: IBM has published a fix for this issue and it is available from the vendor; apply the update identified in IBM support advisory https://www.ibm.com/support/pages/node/7284948 for the exact IBM MQ version and platform in use, and restart the queue manager so the corrected transaction-processing code is loaded. Because the vulnerability is reached through XA transaction handling, compensating controls should focus on shrinking that attack surface while patching is scheduled: restrict which principals may start XA/distributed transactions and use MQ channel authentication (CHLAUTH) rules and TLS client certificates to ensure only trusted, fully authenticated identities reach the queue manager, accepting that this can break legitimate transaction-manager integrations that rely on shared or broadly scoped accounts; block or disable channel access to the queue manager from untrusted network segments at the firewall, with the trade-off that remote application connectivity must be re-scoped; and, where XA coordination is not actually required, disable the external transaction manager integration so XA flows are never parsed, understanding that this removes a capability some applications depend on. Monitor queue manager logs for unexpected process restarts or abends consistent with a crashed channel/agent, and treat any such event on an unpatched system as a possible exploitation attempt. No public exploit code is known at time of analysis, so monitoring and access controls are the primary interim measures until the vendor fix is in place.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM MQ supports XA-compliant distributed transaction processing, in which an external transaction manager coordinates two-phase commits across the queue manager and other resource managers. The XA protocol identifies each branch of a global transaction with an XID structure containing a format ID, global transaction ID and branch qualifier whose lengths are attacker-influenced. The flaw is a buffer overflow (CWE-122 per the classification data, which designates a heap-based overflow, while the vendor description characterises it as a stack buffer overflow - either way the root cause is insufficient bounds validation of a fixed-size buffer into which the XID is copied during transaction processing). The attack surface is the network-reachable channel handling the XA flow (AV:N) at low complexity (AC:L), but it is gated by the need for authenticated access (PR:L) and the ability to invoke XA transaction operations on the queue manager. Successful corruption can terminate the queue manager process (denial of service) or, if the corrupted memory is controllably influenced, be redirected to code execution, which is why the vector assigns High confidentiality, integrity and availability impact without a scope change.
Know when Mq gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable, low-complexity overflow needing authenticated XA access (PR:L); A:H is confirmed DoS while C:H/I:H reflect the vendor-hedged potential RCE.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a stack buffer overflow when processing XA transaction identifiers.
Executive ViewAI
IBM MQ queue managers that process XA distributed transactions are exposed to a memory-corruption flaw that an authenticated network attacker could use to crash the messaging service and potentially execute code within its context. Because IBM MQ typically carries business-critical, non-repudiable transactional traffic, an outage or compromise could disrupt order flow, payment processing, and downstream integrations across affected business units, making remediation a priority even though there is no public exploit identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Remote code execution in IBM MQ is possible when the optional IVT (Installation Verification Test) application is deploy
Malformed compressed data delivered over an IBM MQ channel that has compression enabled can trigger an out-of-bounds hea
IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack wh
Integer overflow (CWE-190) in IBM MQ distribution list processing lets an authenticated user with PUT authority to a dis
Authenticated remote code execution in IBM MQ lets an attacker who holds valid MQ credentials - or who can reach a chann
Heap-based buffer overflow in IBM MQ allows an authenticated, low-privilege attacker who can reach a queue manager to ca
An integer overflow in IBM MQ's MQINQ (inquire object attributes) request processing lets an authenticated remote user c
IBM MQ queue managers running affected releases can be crashed - and, per IBM, potentially have arbitrary code executed
IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their privileges under certain configurations du
Unsafe Java object deserialization in IBM MQ (9.1.0.0-9.1.0.37 LTS, 9.2.0.0-9.2.0.43 LTS, 9.3.0.0-9.3.0.41 LTS / 9.3.0.0
A heap buffer overflow in the IBM MQ client (CWE-787) can be triggered when the client processes crafted messages delive
IBM MQ versions 9.1.0.0 through 9.4.5.1 across LTS and CD streams and 10.0.0.0 are affected by a JNDI injection flaw tha
Exploit-DB