High priorityDisclosed

Advisory · CVE-2026-11376

Authenticated integer overflow in IBM MQ subscription handling

IBM MQ 9.2, 9.3, 9.4, and 10.0 releases could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code via an integer overflow when processing subscription requests with crafted buffer size values. IBM rates it high at CVSS 8.8.

Advisory published November 4, 2026Independent summary
Vendor
IBM
Product
IBM MQ
Identifier / CWE
CVE-2026-11376
CWE-190
Action timing
Immediate
ELI5

Explain it like I’m five

The messaging system does its size math in a counter that can wrap around, like an odometer rolling past zero. An authenticated user who sends a subscription request with a crafted size can make that math go wrong and crash the service or run code.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Authenticated access

    An attacker with low-privilege authenticated access to IBM MQ connects to the messaging system.

  2. 02Crafted subscription request

    The attacker sends a subscription request carrying a crafted buffer size value.

  3. 03Integer overflow

    Processing the value overflows an integer, corrupting the size calculation used for the subscription.

  4. 04Crash or code execution

    The corrupted state can crash the service or potentially allow arbitrary code execution.

What happened

IBM disclosed CVE-2026-11376 in IBM MQ: versions 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow when processing subscription requests with crafted buffer size values. IBM rates it high at CVSS 3.1 8.8.

No fixed version is stated in the NVD record, so this advisory does not name one; operators should follow the remediation IBM lists in its support bulletin.

What to do

  1. Inventory IBM MQ queue managers across the 9.2, 9.3, 9.4, and 10.0 lines listed above.
  2. Apply the remediation IBM lists in its support bulletin for CVE-2026-11376.
  3. Review which accounts hold MQ access and remove any that are stale or over-privileged while patching is underway.
  4. Review MQ logs for unusual subscription requests or unexpected queue manager crashes.
  5. Confirm the deployed version after patching.

Management note

MQ sits at the heart of enterprise message flows, so even an authenticated flaw matters: any compromised low-privilege account becomes a path to crashing or potentially compromising the broker. Treat the patch as part of the wider IBM MQ batch disclosed the same day.