Executive brief
IBM MQ is a message-oriented middleware system used for reliable communication between applications across enterprise networks. The .NET client component is vulnerable to a heap buffer overflow when processing messages from a malicious queue manager or during a man-in-the-middle attack. An attacker can exploit this to cause service denial or execute arbitrary code within client applications, potentially compromising sensitive business data and operations.
Technical details
The vulnerability is a heap buffer overflow (CWE-787) in the IBM MQ .NET client's asynchronous message receive handler. The flaw is triggered when the client receives specially crafted messages from a malicious queue manager or via a man-in-the-middle attacker intercepting queue manager communications. No authentication or user interaction is required. Successful exploitation allows remote code execution in the client process context or denial of service. IBM has released security updates: versions 9.1.0.38, 9.2.0.44, 9.3.0.42, 9.4.0.26 LTS, and 10.0.0.5 address the issue.
Affected products
- IBM MQ 9.1.0.0–9.1.0.37 LTS, 9.2.0.0–9.2.0.43 LTS, 9.3.0.0–9.3.0.41 LTS, 9.3.0.0–9.3.5.1 CD, 9.4.0.0–9.4.0.25 LTS, 9.4.0.0–9.4.5.1 CD, 10.0.0.0
Timeline
- 2026-09-15: disclosed
- 2026-09-14: patched: Security updates available: MQ 9.1.0.38, 9.2.0.44, 9.3.0.42, 9.4.0.26 LTS, 10.0.0.5