EUVD-2026-83129
GHSA-52gg-3863-7xg6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach MQ channel with compression enabled
-
DeliverySend malformed compressed payload
-
ExploitOverflow buffer in decompression routine
-
ExecutionCorrupt process memory
-
ImpactCrash queue manager or run code
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an IBM MQ channel explicitly configured with compression enabled (message/header compression, e.g. COMPMSG/COMPHDR channel attributes) - a channel without compression is not affected, which is the primary limiting factor. The attacker must be able to send data over that channel to the queue manager. LIMITS: although the CVSS vector is PR:N/AC:L, real-world exposure depends on whether the compression-enabled channel is reachable and whether channel authentication (MCAUSER/CHLAUTH/TLS) is enforced; the DoS outcome is readily achievable while reliable arbitrary code execution requires defeating memory protections in the MQ process. Affected: MQ 9.1.0.0-9.1.0.37 LTS, 9.2.0.0-9.2.0.43 LTS, 9.3.0.0-9.3.0.41 LTS / ≤9.3.5.1 CD, 9.4.0.0-9.4.0.25 LTS / ≤9.4.5.1 CD, and 10.0.0.0. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) paints a worst-case network-reachable, unauthenticated RCE, and SSVC agrees on Technical Impact: total. However, the other exploitation signals argue strongly against treating this as an active emergency: EPSS is only 0.37% (31st percentile), SSVC marks Exploitation as 'none' and Automatable as 'no', there is no CISA KEV listing, and no public exploit code is identified. So while the impact ceiling is severe, the likelihood signals are low - this reads as a high-CVSS, low-immediate-real-risk issue that should be patched on a normal-but-prioritized cycle rather than as a fire drill. A key tension to flag: the description gates the flaw on 'channels configured with compression enabled,' which is a deployment prerequisite the AV:N/PR:N vector does not capture - reliable arbitrary code execution from a heap/stack buffer overflow (CWE-787) is also generally harder to weaponize than the DoS path, so the 'execute arbitrary code' claim is more aspirational than demonstrated here. SSVC 'Automatable: no' is consistent with that. Net: real priority for MQ operators who have compression enabled, lower priority for those who do not. |
| Exploit ScenarioDerived | An attacker with network reachability to an IBM MQ channel that has message/header compression enabled sends malformed compressed data, triggering a buffer overflow (CWE-787) in the decompression path; at minimum this crashes the queue manager channel (DoS), and in the worst case corrupts memory to execute code in the MQ process context. No public exploit code or active exploitation has been identified, and the compression-enabled channel configuration is a required precondition. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 23, 2026
Malformed compressed data delivered over an IBM MQ channel that has compression enabled can trigger an out-of-bounds heap write, allowing a remote attacker to crash the queue manager and, potentially, execute arbitrary code in the MQ process. The issue affects IBM MQ 9.1.0.0-9.1.0.37 LTS, 9.2.0.0-9.2.0.43 LTS, 9.3.0.0-9.3.0.41 LTS / up to 9.3.5.1 CD, 9.4.0.0-9.4.0.25 LTS / up to 9.4.5.1 CD, and 10.0.0.0, with the CVSS base of 9.8 reflecting a network-reachable, unauthenticated worst case, though our assessed vector raises attack complexity to High (AC:H) because the channel must be explicitly configured with compression and reachable by the attacker. Denial of service is the readily achievable outcome, while reliable code execution requires defeating the process's memory protections; no public exploit code has been identified at time of analysis, SSVC rates exploitation as none, and EPSS is low at 0.37% (31st percentile).
Earlier versions of this analysis (1)
Malformed compressed data delivered to an IBM MQ channel that has message compression enabled can overflow a buffer during decompression, letting a remote, unauthenticated attacker crash the queue manager (denial of service) or potentially execute arbitrary code in the broker's context (CVSS 8.1). The attack is gated by configuration: only channels with COMPMSG/COMPHDR compression active are exposed, channels left at the default no-compression setting are not affected, and the AC:H rating reflects the difficulty of crafting decompression input that deterministically overflows the buffer rather than merely corrupting memory. IBM has released a fix via its support advisory, and no public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
IBM has released vendor patches; apply the current fix pack for your release track as documented in the IBM support page at https://www.ibm.com/support/pages/node/7284893, covering MQ 9.1, 9.2, 9.3 (LTS and CD), 9.4 (LTS and CD), and 10.0.0.0. Because the vulnerable code path requires a channel with compression active, the most effective immediate workaround is to disable message and header compression on all channel definitions (set COMPMSG and COMPHDR to NONE, including on SVRCONN, RCVR, RQSTR, and cluster sender/receiver channels) and restart or refresh the affected channels, accepting the trade-off of increased network bandwidth and larger message transfer sizes until patching is complete. Where compression cannot be turned off, restrict exposure by enforcing channel authentication records (CHLAUTH) and blocking MQ channel ports such as 1414 from untrusted networks, requiring TLS with mutual certificate authentication, and applying the principle of least privilege to MCAUSER identities; these controls reduce reachability and the blast radius but do not eliminate the underlying memory-corruption flaw and should be treated as temporary compensating measures. Monitor queue manager error logs and FDCs for abnormal terminations that could indicate exploitation attempts, and plan a maintenance window for the fix pack since patching a queue manager requires an outage.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-787 (out-of-bounds write) in IBM MQ's handling of compressed message payloads or headers on channels where compression is configured (for example the COMPMSG and COMPHDR channel attributes). When the queue manager decompresses attacker-supplied data, a length or size value derived from the malformed input is not adequately validated against the destination buffer, so a write can occur past the end of an allocated heap region, corrupting adjacent memory. IBM MQ is a message-oriented middleware product widely deployed for enterprise application integration, and its channel architecture is designed to accept connections from remote queue managers and clients over the network, meaning any reachable channel with compression turned on constitutes the attack surface; the CPE string cpe:2.3:a:ibm:mq:*:*:*:*:*:*:*:* reflects that the advisory covers the product family rather than a single fixed build. Because the corruption happens in the MQ process, both a crash of the queue manager (denial of service affecting all connected applications) and, in principle, attacker-influenced control flow are possible, which is why the integrity and confidentiality impacts are rated High alongside availability, even though the assessed AC:H acknowledges that weaponizing the overflow into reliable code execution is nontrivial.
Know when Mq gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated, but the non-default compression-enabled channel requirement plus buffer-overflow exploitation difficulty justify AC:H rather than IBM's AC:L; full triad impact on the MQ process.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a buffer overflow when processing malformed compressed data on channels configured with compression enabled.
Executive ViewAI
IBM MQ is affected by a critical vulnerability that could allow a remote attacker to crash the queue manager or potentially execute arbitrary code, but exploitation requires the channel to have compression enabled and be reachable. No public exploit identified at time of analysis, and the assessed attack complexity is high. Organizations relying on IBM MQ for critical messaging should prioritize patching to prevent potential service disruptions and data compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Remote code execution in IBM MQ is possible when the optional IVT (Installation Verification Test) application is deploy
IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack wh
IBM MQ queue managers that process XA (X/Open distributed) transactions are vulnerable to a memory-corruption buffer ove
Integer overflow (CWE-190) in IBM MQ distribution list processing lets an authenticated user with PUT authority to a dis
Authenticated remote code execution in IBM MQ lets an attacker who holds valid MQ credentials - or who can reach a chann
Heap-based buffer overflow in IBM MQ allows an authenticated, low-privilege attacker who can reach a queue manager to ca
An integer overflow in IBM MQ's MQINQ (inquire object attributes) request processing lets an authenticated remote user c
IBM MQ queue managers running affected releases can be crashed - and, per IBM, potentially have arbitrary code executed
IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their privileges under certain configurations du
Unsafe Java object deserialization in IBM MQ (9.1.0.0-9.1.0.37 LTS, 9.2.0.0-9.2.0.43 LTS, 9.3.0.0-9.3.0.41 LTS / 9.3.0.0
A heap buffer overflow in the IBM MQ client (CWE-787) can be triggered when the client processes crafted messages delive
IBM MQ versions 9.1.0.0 through 9.4.5.1 across LTS and CD streams and 10.0.0.0 are affected by a JNDI injection flaw tha
Exploit-DB