IBM MQ Operator: Heap buffer overflow when processing MQPUT message options
Summary
IBM MQ Operator and the IBM MQ Advanced container images contain a heap buffer overflow in the processing of MQPUT operations with malformed message options. An authenticated attacker with low privileges on the network can cause a denial of service or potentially execute arbitrary code. No user interaction is required.
Affected
- IBM MQ Operator: 3.2.0 to <= 3.2.29; 3.3.0 to < 3.4.0; 3.4.1; 3.5.0; 3.5.1 to <= 3.5.3; 3.6.0 to <= 3.6.4; 3.7.0 to <= 3.7.2; 3.8.0; 3.8.1; 3.9.0; 3.9.1; 3.9.2 (default: unaffected)
- IBM MQ Advanced container images: several 9.3, 9.4, 10.0 LTS, CD and SC2 builds (full list in the official CVE record)
Fixed in
- IBM MQ Operator v4.1.0 (CD release, includes MQ Advanced 10.0.1.0-r1)
- IBM MQ Operator v4.0.5 (SC2 release, includes MQ Advanced 10.0.0.5-r2)
- IBM MQ Operator v3.2.30 (SC2 release, includes MQ Advanced 9.4.0.26-r2)
- IBM MQ Container 10.0.1.0-r1 and 10.0.0.5-r2
Source: official CVE record (IBM). Verify on the IBM bulletin before rollout.
Workaround
Unknown. IBM has not published a workaround in the sources reviewed. General measure: restrict which identities may put messages to queues and keep MQ channels internal.
Exploitation
- Not known to be exploited in the wild; not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No verified public proof of concept.
Our recommendation
- Check whether MQ Operator or MQ Advanced container images are deployed and at which version.
- Patch to the fixed version named in IBM's bulletin (node/7292667) within the standard emergency window.
- Until patched, limit MQ channel exposure and restrict credentials that can put messages.
- Monitor CISA KEV and vendor advisories for exploitation.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin node/7292667 www.ibm.com
- HOL Guard: CVE-2026-10572 IBM MQ buffer overflow hol.org
- OpenCVE: CVE-2026-10572 app.opencve.io
- Strix: CVE-2026-10572 www.strix.ai
- Offseq: CVE-2026-10572 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:47.
Original description (NVD)
IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT operations with malformed message options.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.