High priorityDisclosed

Advisory · CVE-2026-10574

IBM MQ heap overflow via MQPUT message handle properties can give an authenticated attacker code execution

IBM MQ can allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code through a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties. CVSS 3.1 8.8.

Advisory published October 19, 2026Independent summary
Vendor
IBM
Product
IBM MQ
Identifier / CWE
CVE-2026-10574
CWE-122
Action timing
Immediate
ELI5

Explain it like I’m five

A logged-in MQ user can attach malformed properties to a message handle so that putting the message overflows a heap buffer on the queue manager.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Authenticated session held

    An attacker holds valid MQ credentials and a connection to a queue manager.

  2. 02Malformed properties attached

    The attacker prepares an MQPUT or MQPUT1 operation with malformed message handle properties.

  3. 03Heap overflow triggered

    MQ processing of those properties overflows a heap buffer (CWE-122).

  4. 04Crash or code execution

    The queue manager can be denied service or, per IBM, potentially made to execute arbitrary code.

What happened

IBM PSIRT disclosed CVE-2026-10574: IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow (CWE-122) when processing MQPUT or MQPUT1 operations with malformed message handle properties. The CVSS 3.1 score is 8.8, with low privileges required and no user interaction.

Per the vendor affected data in the NVD record, affected products include IBM MQ Operator across the 2.0 and 3.x lines through 4.0.4, and IBM MQ Advanced container images across the 9.3 and 9.4 LTS and CD lines and 10.0. IBM’s bulletin lists the bulletin issues as addressed in the MQ Operator 4.1.0 CD release (with MQ Advanced 10.0.1.0-r1 images), the 4.0.5 SC2 release (10.0.0.5-r2), and the 3.2.30 SC2 release (9.4.0.26-r2), and states there are no workarounds.

What to do

  1. Inventory IBM MQ deployments, including MQ Operator installs and MQ Advanced container images, and note the fix level of each.
  2. Move to a fixed container release from IBM security bulletin 7292667 for your line: MQ Operator 4.1.0, 4.0.5, or 3.2.30, with the MQ Advanced images the bulletin pairs with each.
  3. Restrict MQ channel and administrative access to trusted networks and named applications while remediation is underway.
  4. Hunt for queue manager crashes tied to MQPUT or MQPUT1 traffic, malformed message handle properties in error logs, and unexpected process behaviour on queue managers.
  5. Verify the deployed fix level after updating, not just that an update ran.

Management note

This is a sibling flaw to CVE-2026-10572 in the same bulletin and the same message-put path. Fix both together, and treat any MQ application identity as more powerful than it was assumed to be until you do.