CVE-2026-11376: IBM MQ integer overflow in subscription request processing

CVE-2026-11376 · Severity: high · CVSS 8.8 · Published 2026-11-04

IBM MQ is a message-oriented middleware platform used to route messages between applications and systems in enterprise environments. An authenticated attacker can exploit an integer overflow vulnerability in the subscription request handler by sending crafted buffer size values, potentially causing the message broker to crash (denial of service) or execute arbitrary code on the server. This vulnerability requires authentication but poses a severe risk to critical messaging infrastructure.

Technologies: IBM Mq. Vendors: IBM.

Quick answers

Is CVE-2026-11376 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-11376 being exploited in the wild.
How severe is CVE-2026-11376?
High severity, with a CVSS score of 8.8, published 4 November 2026.
Which products and versions are affected?
IBM Mq 9.2.0.0–9.2.0.44 LTS, 9.3.0.0–9.3.0.42 LTS, 9.4.0.0–9.4.0.26 LTS, 9.4.0.0–9.4.5.1 CD, 10.0.0.0–10.0.0.5 LTS and CD.
Is there a fix for CVE-2026-11376?
Yes: fixed in IBM MQ 9.2.0.46 LTS, 9.3.0.43 LTS, 9.4.0.30 LTS, 10.0.0.6 LTS, 10.0.1.0 CD. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11376 attacked?
It is attacked over the network.
Am I affected by CVE-2026-11376?
Check whether you run IBM Mq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: IBM MQ 9.2.0.46 LTS, 9.3.0.43 LTS, 9.4.0.30 LTS, 10.0.0.6 LTS, 10.0.1.0 CD

Technical details

An integer overflow vulnerability (CWE-190) exists in IBM MQ's subscription request processing when handling crafted buffer size values. The vulnerability requires authenticated network access to the MQ broker with no additional user interaction. Successful exploitation can lead to denial of service or arbitrary code execution on the affected server component.

Affected products

  • IBM MQ 9.2.0.0–9.2.0.44 LTS, 9.3.0.0–9.3.0.42 LTS, 9.4.0.0–9.4.0.26 LTS, 9.4.0.0–9.4.5.1 CD, 10.0.0.0–10.0.0.5 LTS and CD

Timeline

  • 2026-10-29: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.