High priorityDisclosed

Advisory · CVE-2026-12665

IBM MQ stack overflow via malformed TLS certificate names can give a remote attacker code execution

IBM MQ can allow a remote attacker to execute arbitrary code through a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment. CVSS 3.1 8.1.

Advisory published October 19, 2026Independent summary
Vendor
IBM
Product
IBM MQ
Identifier / CWE
CVE-2026-12665
CWE-121
Action timing
Immediate
ELI5

Explain it like I’m five

Simply starting a TLS connection to MQ with a certificate carrying a malformed name can overflow a stack buffer before the caller has any MQ rights at all.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Channel connection started

    A remote attacker opens a TLS channel connection to an MQ queue manager.

  2. 02Malformed certificate presented

    The client certificate carries a malformed distinguished name.

  3. 03Stack overflow triggered

    MQ processing of the name during connection establishment overflows a stack buffer (CWE-121).

  4. 04Code execution

    Per IBM, the attacker can execute arbitrary code on the queue manager.

What happened

IBM PSIRT disclosed CVE-2026-12665: IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow (CWE-121) when processing TLS certificates with malformed distinguished names during channel connection establishment. The CVSS 3.1 score is 8.1; attack complexity is high, but no privileges or user interaction are required.

Per the vendor affected data in the NVD record, affected products include IBM MQ Operator across the 2.0 and 3.x lines through 4.0.4, and IBM MQ Advanced container images across the 9.3 and 9.4 LTS and CD lines and 10.0. IBM’s bulletin lists the bulletin issues as addressed in the MQ Operator 4.1.0 CD release (with MQ Advanced 10.0.1.0-r1 images), the 4.0.5 SC2 release (10.0.0.5-r2), and the 3.2.30 SC2 release (9.4.0.26-r2), and states there are no workarounds.

What to do

  1. Inventory IBM MQ deployments, including MQ Operator installs and MQ Advanced container images, and note the fix level of each.
  2. Move to a fixed container release from IBM security bulletin 7292667 for your line: MQ Operator 4.1.0, 4.0.5, or 3.2.30, with the MQ Advanced images the bulletin pairs with each.
  3. Restrict MQ channel and administrative access to trusted networks and named applications while remediation is underway.
  4. Hunt for failed or crashed channel connections presenting unusual certificate distinguished names, and TLS handshake errors clustered from single sources.
  5. Verify the deployed fix level after updating, not just that an update ran.

Management note

Unlike the companion MQPUT flaws, this one is reachable before authentication, at the front door every MQ client uses. Internet or partner-facing listeners make it urgent; internal-only listeners still carry it for any compromised peer.