Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

IBM MQ lets signed-in user crash service, view memory

CVE-2026-11831 · published 16 days ago
Summary

IBM MQ on its standard and advanced container versions can be tricked by a logged‑in user into reading memory it shouldn’t, which can cause a short‑term outage and reveal limited internal details. The issue is triggered by a specially crafted client request, so restricting who can connect to MQ and applying the latest security updates reduces the risk. Ensure only trusted users have access and keep the software up to date with IBM’s patches.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ibm mq operator <= 3.2.29
ibm mq advanced container images 9.4.0.6-r1
Original advisory text
IBM MQ Heap-based Buffer Overflow
IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited information about process memory layout due to an out-of-bounds read when processing a specially crafted client request.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-122Heap-based Buffer Overflow
Timeline
Published19 Oct 2026
Updated29 Oct 2026
First seen19 Oct 2026
Sources
CVE-2026-11831 · NVD
CVE-2026-11831 · MITRE
Track software like this
Free during beta