EUVD-2026-83292
GHSA-w35j-3p8f-wphj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid MQ credentials/connection authority
-
DeliveryConnect to queue manager over network
-
ExploitSend crafted MQINQ request
-
ExecutionTrigger integer overflow in request processing
-
ImpactCrash queue manager or execute code
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated MQ connection (PR:L): the attacker must possess valid credentials or connection authority to a reachable queue manager and be able to issue MQINQ (inquire object attributes) API/administrative requests. Exploitation is network-based against the queue manager's listener (default 1414/tcp), needs no user interaction, and targets the MQINQ request-processing path specifically. Limiting factors: valid MQ authentication is mandatory (channel authentication records, TLS/SSL client auth, or CONNAUTH restrictions further raise the bar), and reliable arbitrary code execution is described by the vendor only as a potential outcome rather than a confirmed capability, so DoS is the more assured impact. |
| Impact | This is a genuinely high-priority issue for environments running IBM MQ. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw exploitable by any authenticated MQ user, with full confidentiality/integrity/availability impact. The CWE-190 integer overflow in MQINQ (inquire) request processing supports a clear denial-of-service path (queue manager crash), while the description's 'potentially execute arbitrary code' qualifier means the RCE outcome is possible but not vendor-confirmed as reliably achievable - the C:H/I:H rating leans on that unproven upside, so real-world impact may in practice be closer to DoS. No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no evidence of active exploitation or automated weaponization; treat the score as a capability ceiling rather than proof of imminent attack. The requirement for authenticated access (PR:L) is the key limiter: an attacker must already hold valid MQ credentials/connection authority, which meaningfully narrows the threat to insiders or attackers who have harvested MQ application credentials. Priority is justified by MQ's role in critical transaction/messaging backbones plus the availability of a vendor patch - patch promptly, but the lack of EPSS/KEV/POC signals this is not yet mass-exploited. |
| Exploit ScenarioDerived | An attacker holding valid IBM MQ connection credentials (an application service account or a low-privilege user) sends a crafted MQINQ request whose parameters trigger an integer overflow during processing by the queue manager. The malformed request crashes or destabilizes the queue manager (denial of service) and, per the vendor description, could potentially be leveraged toward arbitrary code execution on the MQ server. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
An integer overflow in IBM MQ's MQINQ (inquire object attributes) request processing lets an authenticated remote user crash the queue manager and, per the vendor, potentially execute arbitrary code, giving the issue a CVSS 3.1 base score of 8.8 with high confidentiality, integrity and availability impact. Exploitation is network-based against the queue manager listener (default 1414/tcp), requires valid MQ credentials or connection authority (PR:L) and no user interaction; the vendor describes reliable code execution as a potential rather than confirmed outcome, so denial of service is the more assured impact. No public exploit identified at time of analysis, and a vendor fix is available per the IBM advisory.
RemediationAI
Prioritise the vendor fix: IBM has published remediation for this issue and patch status is 'Patch available per vendor advisory' - obtain the exact APAR and fixed MQ maintenance level from https://www.ibm.com/support/pages/node/7284944 and apply it to every queue manager, since no version numbers are supplied in the collected data and should not be guessed. If patching cannot be done immediately, reduce the attack surface by restricting who can reach the queue manager listener: block 1414/tcp (and any secondary listeners) at the network and host firewall so only known application and administration hosts can connect - the trade-off is that mis-scoped rules break legitimate messaging clients. Enforce strong authentication and authorization on the request path: require TLS client certificate authentication on SVRCONN channels, configure CHLAUTH records and CONNAUTH/ADOPTCTX so the connection identity is authoritative, and remove or tightly scope the MQINQ authority of low-privilege application accounts, since the vulnerability is only reachable with an authenticated PR:L foothold; the trade-off is additional client certificate and channel management overhead and potential disruption of existing clients. Monitoring cannot prevent the overflow but can detect an attempt: alert on repeated MQINQ failures, queue manager process aborts, and unexpected FDC/AMQ error dumps from the queue manager, and review MQ error logs for MQINQ-related anomalies. Note finally that patching is the only measure that removes the memory-corruption root cause; firewall and authorization changes are compensating controls that limit blast radius rather than eliminate the flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM MQ is message-oriented middleware that brokers messages between applications over channels such as SVRCONN, with administration and API traffic handled by the queue manager on a network listener (1414/tcp by default). The MQINQ call is an inquire API used by clients and administrative tooling to retrieve attributes of MQ objects such as queues and channels; the flaw is classified CWE-190 (Integer Overflow or Wraparound), meaning attacker-influenced values in an MQINQ request are not bounds-checked before arithmetic is performed during request processing, producing a wrapped length or offset that can corrupt memory and terminate the queue manager process, with the possibility of further control-flow consequences. The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates the attack is launched over the network with low complexity, needs a low-privileged authenticated identity, requires no user interaction, and stays within the MQ security scope while affecting all three impact metrics. The supplied CPE is wildcarded (cpe:2.3:a:ibm:mq:*:*:*:*:*:*:*:*), so it confirms the product family but does not pin specific version ranges; exact affected maintenance levels, platforms and APAR/fix details must be read from IBM's advisory. Reachability depends on exposing a queue manager listener to the attacker and on channel authentication records, CONNAUTH settings and TLS client authentication - where these are enforced, the required PR:L foothold becomes materially harder to obtain.
Know when Mq gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable queue manager, low complexity, but a valid authenticated MQ connection is required (PR:L); DoS is certain (A:H) and vendor-claimed potential RCE justifies C:H/I:H.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing.
Executive ViewAI
IBM MQ queue managers are affected by a high-severity integer overflow in MQINQ request processing that an authenticated remote attacker could use to crash the service and, per IBM, potentially execute arbitrary code. Organizations relying on IBM MQ for message delivery face disruption to dependent applications and possible data integrity or confidentiality exposure if code execution is achieved. Leadership should prioritize remediation because the queue manager is often a shared backbone service, and a successful attack requires only valid MQ credentials and network access to the listener.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Remote code execution in IBM MQ is possible when the optional IVT (Installation Verification Test) application is deploy
Malformed compressed data delivered over an IBM MQ channel that has compression enabled can trigger an out-of-bounds hea
IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack wh
IBM MQ queue managers that process XA (X/Open distributed) transactions are vulnerable to a memory-corruption buffer ove
Integer overflow (CWE-190) in IBM MQ distribution list processing lets an authenticated user with PUT authority to a dis
Authenticated remote code execution in IBM MQ lets an attacker who holds valid MQ credentials - or who can reach a chann
Heap-based buffer overflow in IBM MQ allows an authenticated, low-privilege attacker who can reach a queue manager to ca
IBM MQ queue managers running affected releases can be crashed - and, per IBM, potentially have arbitrary code executed
IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their privileges under certain configurations du
Unsafe Java object deserialization in IBM MQ (9.1.0.0-9.1.0.37 LTS, 9.2.0.0-9.2.0.43 LTS, 9.3.0.0-9.3.0.41 LTS / 9.3.0.0
A heap buffer overflow in the IBM MQ client (CWE-787) can be triggered when the client processes crafted messages delive
IBM MQ versions 9.1.0.0 through 9.4.5.1 across LTS and CD streams and 10.0.0.0 are affected by a JNDI injection flaw tha
Exploit-DB