High priorityDisclosed

Advisory · CVE-2026-10572

IBM MQ heap overflow in MQPUT handling can give an authenticated attacker code execution

IBM MQ can allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code through a heap buffer overflow when processing MQPUT operations with malformed message options. CVSS 3.1 8.8.

Advisory published October 19, 2026Independent summary
Vendor
IBM
Product
IBM MQ
Identifier / CWE
CVE-2026-10572
CWE-122
Action timing
Immediate
ELI5

Explain it like I’m five

A logged-in MQ user can send a message with malformed options that overflows a heap buffer on the queue manager, crashing it or running code in its place.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Authenticated session held

    An attacker holds valid MQ credentials and a connection to a queue manager.

  2. 02Malformed MQPUT sent

    The attacker issues an MQPUT operation carrying malformed message options.

  3. 03Heap overflow triggered

    MQ processing of those options overflows a heap buffer (CWE-122).

  4. 04Crash or code execution

    The queue manager can be denied service or, per IBM, potentially made to execute arbitrary code.

What happened

IBM PSIRT disclosed CVE-2026-10572: IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow (CWE-122) when processing MQPUT operations with malformed message options. The CVSS 3.1 score is 8.8, with low privileges required and no user interaction.

Per the vendor affected data in the NVD record, affected products include IBM MQ Operator across the 2.0 and 3.x lines through 4.0.4, and IBM MQ Advanced container images across the 9.3 and 9.4 LTS and CD lines and 10.0. IBM’s bulletin lists the bulletin issues as addressed in the MQ Operator 4.1.0 CD release (with MQ Advanced 10.0.1.0-r1 images), the 4.0.5 SC2 release (10.0.0.5-r2), and the 3.2.30 SC2 release (9.4.0.26-r2), and states there are no workarounds.

What to do

  1. Inventory IBM MQ deployments, including MQ Operator installs and MQ Advanced container images, and note the fix level of each.
  2. Move to a fixed container release from IBM security bulletin 7292667 for your line: MQ Operator 4.1.0, 4.0.5, or 3.2.30, with the MQ Advanced images the bulletin pairs with each.
  3. Restrict MQ channel and administrative access to trusted networks and named applications while remediation is underway.
  4. Hunt for queue manager crashes tied to MQPUT traffic, malformed message options in error logs, and unexpected code or process behaviour on queue managers.
  5. Verify the deployed fix level after updating, not just that an update ran.

Management note

MQ carries payment, order, and integration traffic between systems that trust it. An authenticated path to code execution on the queue manager is a lateral-movement risk, so patch on the urgent ring and review who can put messages at all.