High priorityDisclosed

Advisory · CVE-2026-10743

IBM MQ MQOPEN buffer-size validation flaw lets an authenticated attacker corrupt memory

IBM MQ can allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations. CVSS 3.1 8.8.

Advisory published October 19, 2026Independent summary
Vendor
IBM
Product
IBM MQ
Identifier / CWE
CVE-2026-10743
CWE-1223
Action timing
Immediate
ELI5

Explain it like I’m five

Opening a queue with crafted buffer sizes can corrupt the queue manager's memory, because MQ trusts the sizes it is handed instead of checking them.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Authenticated session held

    An attacker holds valid MQ credentials and a connection to a queue manager.

  2. 02Crafted MQOPEN sent

    The attacker issues an MQOPEN operation with improper buffer sizes.

  3. 03Sizes not validated

    MQ processes the operation without properly validating the buffer sizes.

  4. 04Memory corrupted

    The queue manager's memory can be corrupted, causing a denial of service.

What happened

IBM PSIRT disclosed CVE-2026-10743: IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations. The CVSS 3.1 score is 8.8, with low privileges required and no user interaction. The record’s CVSS metric is marked secondary, which is why severity-filtered NVD queries can miss it; it surfaced through IBM’s bulletin instead.

Per the vendor affected data in the NVD record, affected products include IBM MQ Operator across the 2.0 and 3.x lines through 4.0.4, and IBM MQ Advanced container images across the 9.3 and 9.4 LTS and CD lines and 10.0. IBM’s bulletin lists the bulletin issues as addressed in the MQ Operator 4.1.0 CD release (with MQ Advanced 10.0.1.0-r1 images), the 4.0.5 SC2 release (10.0.0.5-r2), and the 3.2.30 SC2 release (9.4.0.26-r2), and states there are no workarounds.

What to do

  1. Inventory IBM MQ deployments, including MQ Operator installs and MQ Advanced container images, and note the fix level of each.
  2. Move to a fixed container release from IBM security bulletin 7292667 for your line: MQ Operator 4.1.0, 4.0.5, or 3.2.30, with the MQ Advanced images the bulletin pairs with each.
  3. Restrict MQ channel and administrative access to trusted networks and named applications while remediation is underway.
  4. Hunt for queue manager crashes or instability tied to MQOPEN traffic, and unexpected process behaviour on queue managers.
  5. Verify the deployed fix level after updating, not just that an update ran.

Management note

MQOPEN is among the most ordinary operations in MQ, performed by every connecting application. A memory-corruption flaw on that path means any application identity is a queue-manager stability risk until the fixed images are in.