# CVE-2026-11376: IBM MQ integer overflow in subscription request processing

Source: https://junglewise.ai/threats/cve-2026-11376-ibm-mq-9-2-0-0-through-9-2-0-44-lts-9-3-0-0-through-9-3-0-42-lts  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-11376 · Severity: high · CVSS 8.8 · Published 2026-11-04

IBM MQ is a message-oriented middleware platform used to route messages between applications and systems in enterprise environments. An authenticated attacker can exploit an integer overflow vulnerability in the subscription request handler by sending crafted buffer size values, potentially causing the message broker to crash (denial of service) or execute arbitrary code on the server. This vulnerability requires authentication but poses a severe risk to critical messaging infrastructure.

Technologies: [IBM Mq](https://junglewise.ai/threats/technologies/mq). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-11376 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11376 being exploited in the wild.

**How severe is CVE-2026-11376?** High severity, with a CVSS score of 8.8, published 4 November 2026.

**Which products and versions are affected?** IBM Mq 9.2.0.0–9.2.0.44 LTS, 9.3.0.0–9.3.0.42 LTS, 9.4.0.0–9.4.0.26 LTS, 9.4.0.0–9.4.5.1 CD, 10.0.0.0–10.0.0.5 LTS and CD.

**Is there a fix for CVE-2026-11376?** Yes: fixed in IBM MQ 9.2.0.46 LTS, 9.3.0.43 LTS, 9.4.0.30 LTS, 10.0.0.6 LTS, 10.0.1.0 CD. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-11376 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-11376?** Check whether you run IBM Mq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in IBM MQ 9.2.0.46 LTS, 9.3.0.43 LTS, 9.4.0.30 LTS, 10.0.0.6 LTS, 10.0.1.0 CD

## Technical details

An integer overflow vulnerability (CWE-190) exists in IBM MQ's subscription request processing when handling crafted buffer size values. The vulnerability requires authenticated network access to the MQ broker with no additional user interaction. Successful exploitation can lead to denial of service or arbitrary code execution on the affected server component.

## Affected products

- IBM MQ 9.2.0.0–9.2.0.44 LTS, 9.3.0.0–9.3.0.42 LTS, 9.4.0.0–9.4.0.26 LTS, 9.4.0.0–9.4.5.1 CD, 10.0.0.0–10.0.0.5 LTS and CD

## Timeline

- 2026-10-29: disclosed

## References

- [https://www.ibm.com/support/pages/node/7294498](https://www.ibm.com/support/pages/node/7294498)

## Related threats

- [IBM MQ integer overflow in malformed MQINQ request](https://junglewise.ai/threats/cve-2026-18142-ibm-mq-9-2-0-0-through-9-2-0-44-lts-9-3-0-0-through-9-3-0-42-lts)
- [IBM MQ password disclosure in log files](https://junglewise.ai/threats/cve-2026-14252-ibm-mq-9-2-0-0-through-9-2-0-44-lts-9-3-0-0-through-9-3-0-42-lts)
- [IBM MQ Managed File Transfer arbitrary code execution via environment variables](https://junglewise.ai/threats/cve-2026-13292-ibm-mq-9-2-0-0-through-9-2-0-44-lts-9-3-0-0-through-9-3-0-42-lts)
- [IBM MQ XML external entity injection in Managed File Transfer](https://junglewise.ai/threats/cve-2026-13289-ibm-mq-9-2-0-0-through-9-2-0-44-lts-9-3-0-0-through-9-3-0-42-lts)
- [IBM MQ XML external entity injection in Managed File Transfer](https://junglewise.ai/threats/cve-2026-13284-ibm-mq-9-2-0-0-through-9-2-0-44-lts-9-3-0-0-through-9-3-0-42-lts)