CVE-2026-11728
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
A heap buffer overflow vulnerability in IBM MQ occurs when receiving messages from a malicious queue manager or through a man-in-the-middle attack. It affects multiple LTS and CD versions, including 9.1, 9.2, 9.3, 9.4, and 10.0.0.0. It could allow a remote attacker to cause a denial of service or potentially execute arbitrary code in the client.
Risk Assessment
Organizations using IBM MQ are exposed to service disruptions or client takeover by an attacker. This could lead to data leakage, loss of business continuity, or further escalation within the network.
Recommendation
Immediately update IBM MQ to the latest patched version and implement authentication and connection encryption mechanisms to reduce the risk of man-in-the-middle attacks.
Other vulnerabilities in IBM MQ
See all- CVE-2026-12351Critical
IBM MQ versions 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0 could allow a remote attacker to execute arbitrary code due to unsafe JNDI lookup processing when the IVT application is deployed.
- CVE-2026-14511Medium
IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to cause a denial of service by sending a specially crafted message that crashes consuming applications. The impact is on availability.
- CVE-2026-12727Medium
IBM MQ could allow an authenticated attacker to cause process instability due to an off-by-one buffer overflow when processing specially crafted object names. This may lead to service disruption.
- CVE-2026-12670Medium
IBM MQ contains a vulnerability that allows an authenticated attacker to cause a denial of service through a specially crafted message that triggers excessive memory operations during character set conversion.
- CVE-2026-12669Low
IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected.
- CVE-2026-12665High
IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment. The vulnerability occurs in the TLS certificate processing.
- CVE-2026-12350Medium
IBM MQ allows an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process.
- CVE-2026-12343Medium
IBM MQ allows an authenticated attacker to cause a denial of service due to improper validation of RFH2 message header fields in queued publish/subscribe operations.
- CVE-2026-12155Medium
IBM MQ allows an authenticated attacker to cause a denial of service by sending specially crafted multicast status messages that trigger a NULL pointer dereference.
- CVE-2026-11831Medium
IBM MQ allows an authenticated attacker to cause a limited denial of service and obtain very limited information about process memory layout due to an out-of-bounds read when processing a specially crafted client request.
Original NVD description (English source)
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote attacker to cause a denial of service or potentially execute arbitrary code in the client due to a heap buffer overflow when receiving messages from a malicious queue manager or through a man-in-the-middle attack.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS