Executive brief
IBM MQ is a message queuing system used by enterprises to route and queue application messages. A heap buffer overflow vulnerability in the queue manager's message decompression handler allows unauthenticated remote attackers with network access to the listener port to execute arbitrary code or cause service outages, particularly when compression is enabled on message channels.
Technical details
This is an out-of-bounds heap write vulnerability (CWE-787) in IBM MQ's decompression logic triggered by processing malformed compressed data on channels configured with compression. The vulnerability requires network access to the MQ listener port but no authentication or user interaction. An unauthenticated remote attacker can craft malicious compressed messages to overflow the heap buffer, achieving arbitrary code execution or denial of service. Patches are available for supported versions: 9.1.0.38 LTS, 9.2.0.44 LTS, 9.3.0.42 LTS, 9.4.0.26 LTS, and 10.0.0.5 or later.
Affected products
- IBM MQ 9.1.0.0–9.1.0.37 LTS, 9.2.0.0–9.2.0.43 LTS, 9.3.0.0–9.3.0.41 LTS, 9.3.0.0–9.3.5.1 CD, 9.4.0.0–9.4.0.25 LTS, 9.4.0.0–9.4.5.1 CD, 10.0.0.0
Timeline
- 2026-09-14: disclosed: Initial security bulletin publication
- 2026-09-14: patched: Cumulative security updates released for LTS versions; 10.0.0.5 for 10.0.0.0